From https://github.com/libgit2/libgit2/releases: | This is a security release fixing out-of-bounds reads when | processing smart-protocol "ng" packets. | | When parsing an "ng" packet, we keep track of both the current position | as well as the remaining length of the packet itself. But instead of | taking care not to exceed the length, we pass the current pointer's | position to strchr, which will search for a certain character until | hitting NUL. It is thus possible to create a crafted packet which | doesn't contain a NUL byte to trigger an out-of-bounds read. | | The issue was discovered by the oss-fuzz project, issue 9406. 0.26.6 and 0.27.4 releases contain the fix; the older versions are vulnerable.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=72c1966bf06a5c6873074c7f5cebc27f6f8bb5c7 commit 72c1966bf06a5c6873074c7f5cebc27f6f8bb5c7 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2018-08-07 06:06:11 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2018-08-07 06:21:34 +0000 dev-libs/libgit2: Sec-bump to 0.27.4 Bug: https://bugs.gentoo.org/662994 dev-libs/libgit2/Manifest | 1 + dev-libs/libgit2/libgit2-0.27.4.ebuild | 80 ++++++++++++++++++++++++++++++++++ 2 files changed, 81 insertions(+) https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=cc124f9c519cb2cc6469c4f9bf774dd1f22d8fec commit cc124f9c519cb2cc6469c4f9bf774dd1f22d8fec Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2018-08-07 05:51:57 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2018-08-07 06:21:34 +0000 dev-libs/libgit2: Sec-bump to 0.26.6 Bug: https://bugs.gentoo.org/662994 dev-libs/libgit2/Manifest | 1 + dev-libs/libgit2/libgit2-0.26.6.ebuild | 80 ++++++++++++++++++++++++++++++++++ 2 files changed, 81 insertions(+)
Arch teams, please test and stabilize the fixed version.
amd64 stable
x86 stable
GLSA Vote: No! @ Maintainer(s): Please cleanup and drop <dev-libs/libgit2-0.26.6 and <dev-libs/libgit2-0.27.4!
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c22582f2f5edd207a7d2dbe15d549701d04a3986 commit c22582f2f5edd207a7d2dbe15d549701d04a3986 Author: Michał Górny <mgorny@gentoo.org> AuthorDate: 2018-08-08 02:55:02 +0000 Commit: Michał Górny <mgorny@gentoo.org> CommitDate: 2018-08-08 02:55:02 +0000 dev-libs/libgit2: Remove vulnerable versions Bug: https://bugs.gentoo.org/662994 dev-libs/libgit2/Manifest | 2 - dev-libs/libgit2/libgit2-0.26.5.ebuild | 80 ---------------------------------- dev-libs/libgit2/libgit2-0.27.3.ebuild | 80 ---------------------------------- 3 files changed, 162 deletions(-)
