--------------------------------------------------------------------------------
Fedora EPEL Update Notification
FEDORA-EPEL-2018-0be0127779
2018-09-06 01:00:06.958618
--------------------------------------------------------------------------------
Name : libgit2
Product : Fedora EPEL 7
Version : 0.26.6
Release : 1.el7
URL :
http://libgit2.github.com/
Summary : C implementation of the Git core methods as a library with a solid API
Description :
libgit2 is a portable, pure C implementation of the Git core methods
provided as a re-entrant linkable library with a solid API, allowing
you to write native speed custom Git applications in any language
with bindings.
--------------------------------------------------------------------------------
Update Information:
This is a security release fixing out-of-bounds reads when processing smart-
protocol "ng" packets. When parsing an "ng" packet, we keep track of
both the
current position as well as the remaining length of the packet itself. But
instead of taking care not to exceed the length, we pass the current pointer's
position to strchr, which will search for a certain character until hitting NUL.
It is thus possible to create a crafted packet which doesn't contain a NUL byte
to trigger an out-of-bounds read. The issue was discovered by the oss-fuzz
project, issue 9406.
--------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use
su -c 'yum update libgit2' at the command line.
For more information, refer to "YUM", available at
https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7\
/html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------