kritik
CVE-2016-2315
git: path_name() integer truncation and overflow leading to buffer overflow
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.
Kaynağa göre önem derecesi
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat6.8AV:N/AC:M/Au:N/C:P/I:P/A:P
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (yüksek), Amazon (yüksek), Oracle (yüksek), Ubuntu (yüksek).
Açıklama
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | emacs-git, emacs-git-el, git ve 12 tane daha | 2.7.4-1.47.amzn1 |
| debian 11 | git | 1:2.7.0-1 |
| debian 12 | git | 1:2.7.0-1 |
| debian 13 | git | 1:2.7.0-1 |
| debian 14 | git | 1:2.7.0-1 |
| debian 7 | git | 1:1.7.10.4-1+wheezy3 |
| debian 8 | git | 1:2.1.4-2.1+deb8u2 |
| echo | git | 1:2.7.0-1 |
| Oracle Linux 6 | emacs-git, emacs-git-el, git ve 9 tane daha | 1.7.1-4.el6_7.1 |
| Oracle Linux 7 | emacs-git, emacs-git-el, git ve 13 tane daha | 1.8.3.1-6.el7_2.1 |
| root.io debian 11 | rootio-git | 1:2.7.0-1 |
| root.io debian 12 | rootio-git | 1:2.7.0-1 |
16 kaynaktaki 56 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| amazon linux 1 | emacs-git | 2.7.4-1.47.amzn1 |
| amazon linux 1 | emacs-git-el | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-all | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-bzr | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-cvs | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-daemon | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-debuginfo | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-email | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-hg | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-p4 | 2.7.4-1.47.amzn1 |
| amazon linux 1 | git-svn | 2.7.4-1.47.amzn1 |
| amazon linux 1 | gitweb | 2.7.4-1.47.amzn1 |
| amazon linux 1 | perl-Git | 2.7.4-1.47.amzn1 |
| amazon linux 1 | perl-Git-SVN | 2.7.4-1.47.amzn1 |
| debian 11 | git | 1:2.7.0-1 |
| debian 12 | git | 1:2.7.0-1 |
| debian 13 | git | 1:2.7.0-1 |
| debian 14 | git | 1:2.7.0-1 |
| debian 7 | git | 1:1.7.10.4-1+wheezy3 |
| debian 8 | git | 1:2.1.4-2.1+deb8u2 |
| echo | git | 1:2.7.0-1 |
| Oracle Linux 6 | emacs-git | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | emacs-git-el | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-all | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-cvs | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-daemon | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-email | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-gui | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | git-svn | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | gitk | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | gitweb | 1.7.1-4.el6_7.1 |
| Oracle Linux 6 | perl-Git | 1.7.1-4.el6_7.1 |
| Oracle Linux 7 | emacs-git | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | emacs-git-el | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-all | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-bzr | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-cvs | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-daemon | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-email | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-gui | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-hg | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-p4 | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | git-svn | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | gitk | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | gitweb | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | perl-Git | 1.8.3.1-6.el7_2.1 |
| Oracle Linux 7 | perl-Git-SVN | 1.8.3.1-6.el7_2.1 |
| root.io debian 11 | rootio-git | 1:2.7.0-1 |
| root.io debian 12 | rootio-git | 1:2.7.0-1 |
| root.io debian 13 | rootio-git | 1:2.7.0-1 |
| ubuntu 12.04 | git | 1:1.7.9.5-1ubuntu0.3 |
| ubuntu 14.04 | git | 1:1.9.1-1ubuntu0.3 |
| ubuntu 15.10 | git | 1:2.5.0-1ubuntu0.2 |
Referanslar
- http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.html
32 referansın hepsi
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html
- http://lists.opensuse.org/opensuse-updates/2016-04/msg00011.html
- http://pastebin.com/UX2P2jjg
- http://rhn.redhat.com/errata/RHSA-2016-0496.html
- http://www.debian.org/security/2016/dsa-3521
- http://www.openwall.com/lists/oss-security/2016/03/15/5
- http://www.openwall.com/lists/oss-security/2016/03/16/2
- http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html
- http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
- http://www.securityfocus.com/bid/84355
- http://www.securitytracker.com/id/1035290
- http://www.ubuntu.com/usn/USN-2938-1
- https://access.redhat.com/security/cve/CVE-2016-2315
- https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305
- https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60
- https://linux.oracle.com/cve/CVE-2016-2315.html
- https://linux.oracle.com/errata/ELSA-2016-0496.html
- https://nvd.nist.gov/vuln/detail/CVE-2016-2315
- https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt
- https://security.gentoo.org/glsa/201605-01
- https://ubuntu.com/security/notices/USN-2938-1
- https://www.cve.org/CVERecord?id=CVE-2016-2315