critique
CVE-2016-2315
git: path_name() integer truncation and overflow leading to buffer overflow
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (élevée), Amazon (élevée), Oracle (élevée), Ubuntu (élevée).
Description
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | emacs-git, emacs-git-el, git et 12 autres | 2.7.4-1.47.amzn1 |
| debian 11 | git | 1:2.7.0-1 |
| debian 12 | git | 1:2.7.0-1 |
| debian 13 | git | 1:2.7.0-1 |
| debian 14 | git | 1:2.7.0-1 |
| debian 7 | git | 1:1.7.10.4-1+wheezy3 |
| debian 8 | git | 1:2.1.4-2.1+deb8u2 |
| echo | git | 1:2.7.0-1 |
| Oracle Linux 6 | emacs-git, emacs-git-el, git et 9 autres | 1.7.1-4.el6_7.1 |
| Oracle Linux 7 | emacs-git, emacs-git-el, git et 13 autres | 1.8.3.1-6.el7_2.1 |
| root.io debian 11 | rootio-git | 1:2.7.0-1 |
| root.io debian 12 | rootio-git | 1:2.7.0-1 |
Afficher les 56 entrées de 16 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| amazon linux 1 | emacs-git | 2.7.4-1.47.amzn1 |
| amazon linux 1 | emacs-git-el | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-all | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-bzr | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-cvs | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-daemon | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-debuginfo | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-email | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-hg | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-p4 | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-svn | 2.7.4-1.47.amzn1 |
| amazon linux 1 | gitweb | 2.7.4-1.47.amzn1 |
| amazon linux 1 | perl-Git | 2.7.4-1.47.amzn1 |
| amazon linux 1 | perl-Git-SVN | 2.7.4-1.47.amzn1 |
| debian 11 | git | 1:2.7.0-1 |
| debian 12 | git | 1:2.7.0-1 |
| debian 13 | git | 1:2.7.0-1 |
| debian 14 | git | 1:2.7.0-1 |
| debian 7 | git | 1:1.7.10.4-1+wheezy3 |
| debian 8 | git | 1:2.1.4-2.1+deb8u2 |
| echo | git | 1:2.7.0-1 |
| Oracle Linux 6 | emacs-git | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | emacs-git-el | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-all | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-cvs | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-daemon | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-email | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-gui | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-svn | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | gitk | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | gitweb | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | perl-Git | 1.7.1-4.el6_7.1 |
| Oracle Linux 7 | emacs-git | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | emacs-git-el | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-all | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-bzr | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-cvs | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-daemon | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-email | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-gui | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-hg | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-p4 | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-svn | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | gitk | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | gitweb | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | perl-Git | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | perl-Git-SVN | 1.8.3.1-6.el7_2.1 |
| root.io debian 11 | rootio-git | 1:2.7.0-1 |
| root.io debian 12 | rootio-git | 1:2.7.0-1 |
| root.io debian 13 | rootio-git | 1:2.7.0-1 |
| ubuntu 12.04 | git | 1:1.7.9.5-1ubuntu0.3 |
| ubuntu 14.04 | git | 1:1.9.1-1ubuntu0.3 |
| ubuntu 15.10 | git | 1:2.5.0-1ubuntu0.2 |
Références
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.html
Les 32 références
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html
- http://lists.opensuse.org/opensuse-updates/2016-04/msg00011.html
- http://pastebin.com/UX2P2jjg
- http://rhn.redhat.com/errata/RHSA-2016-0496.html
- http://www.debian.org/security/2016/dsa-3521
- http://www.openwall.com/lists/oss-security/2016/03/15/5
- http://www.openwall.com/lists/oss-security/2016/03/16/2
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/84355
- http://www.securitytracker.com/id/1035290
- http://www.ubuntu.com/usn/USN-2938-1
- https://access.redhat.com/security/cve/CVE-2016-2315
- https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305
- https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60
- https://linux.oracle.com/cve/CVE-2016-2315.html
- https://linux.oracle.com/errata/ELSA-2016-0496.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-2315
- https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt
- https://security.gentoo.org/glsa/201605-01
- https://ubuntu.com/security/notices/USN-2938-1
- https://www.cve.org/CVERecord?id=CVE-2016-2315