File tree Expand file tree Collapse file tree 1 file changed +3
-6
lines changed Expand file tree Collapse file tree 1 file changed +3
-6
lines changed Original file line number Diff line number Diff line change @@ -73,24 +73,21 @@ Etienne Stalmans) same as v0.27.1.
73
73
Ignores submodule configuration entries with names which attempt to perform path
74
74
traversal and can be exploited to write to an arbitrary path or for remote code
75
75
execution. ` libgit2 ` itself is not vulnerable to RCE but tool implementations
76
- which execute hooks after fetching might be. This is CVE-2018 -11235.
77
-
76
+ which execute hooks after fetching might be. This is CVE-2018 -11235.<br /><br />
78
77
It is forbidden for a ` .gitmodules ` file to be a symlink which could cause a Git
79
78
implementation to write outside of the repository and and bypass the fsck checks
80
79
for CVE-2018 -11235.
81
80
82
81
* ** [ libgit2 v0.26.2] ( https://github.com/libgit2/libgit2/releases/tag/v0.26.2 ) ** , March 8th, 2018
83
82
Fixes memory handling issues when reading crafted repository index files. The
84
83
issues allow for possible denial of service due to allocation of large memory
85
- and out-of-bound reads.
86
-
84
+ and out-of-bound reads.<br /><br />
87
85
As the index is never transferred via the network, exploitation requires an
88
86
attacker to have access to the local repository.
89
87
90
88
* ** [ libgit2 v0.26.1] ( https://github.com/libgit2/libgit2/releases/tag/v0.26.1 ) ** , March 7th, 2018
91
89
Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
92
- vulnerable to security issues in the prior version.
93
-
90
+ vulnerable to security issues in the prior version.<br /><br />
94
91
This does not affect you if you rely on a system-installed version of zlib. All
95
92
users of v0.26.0 who use the bundled zlib should upgrade to this release.
96
93
You can’t perform that action at this time.
0 commit comments