OPENSUSE-SU-2024:10137-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 19:52
Summary
cgit-1.0-1.3 on GA media
Severity
Moderate
Notes
Title of the patch: cgit-1.0-1.3 on GA media
Description of the patch: These are all security issues fixed in the cgit-1.0-1.3 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2024-10137
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2011-2711
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2012-4465
Affected products
Recommended 4 products, the same list as for CVE-2011-2711
Threats
Impact moderate
CVE-2012-4548
Affected products
Recommended 4 products, the same list as for CVE-2011-2711
Threats
Impact moderate
CVE-2013-2117
Affected products
Recommended 4 products, the same list as for CVE-2011-2711
Threats
Impact moderate
CVE-2016-1899
3.7 (Low)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Recommended 4 products, the same list as for CVE-2011-2711
Threats
Impact moderate
CVE-2016-1900
3.7 (Low)
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Recommended 4 products, the same list as for CVE-2011-2711
Threats
Impact moderate
CVE-2016-1901
9.8 (Critical)
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 4 products, the same list as for CVE-2011-2711
Threats
Impact moderate
CVE-2016-2315
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 4 products, the same list as for CVE-2011-2711
Threats
Impact moderate
CVE-2016-2324
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 4 products, the same list as for CVE-2011-2711
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://www.suse.com/security/cve/CVE-2011-2711/ self
https://www.suse.com/security/cve/CVE-2012-4465/ self
https://www.suse.com/security/cve/CVE-2012-4548/ self
https://www.suse.com/security/cve/CVE-2013-2117/ self
https://www.suse.com/security/cve/CVE-2016-1899/ self
https://www.suse.com/security/cve/CVE-2016-1900/ self
https://www.suse.com/security/cve/CVE-2016-1901/ self
https://www.suse.com/security/cve/CVE-2016-2315/ self
https://www.suse.com/security/cve/CVE-2016-2324/ self
https://www.suse.com/security/cve/CVE-2011-2711 external
https://bugzilla.suse.com/707929 external
https://www.suse.com/security/cve/CVE-2012-4465 external
https://bugzilla.suse.com/783012 external
https://www.suse.com/security/cve/CVE-2012-4548 external
https://bugzilla.suse.com/787074 external
https://www.suse.com/security/cve/CVE-2013-2117 external
https://bugzilla.suse.com/822166 external
https://www.suse.com/security/cve/CVE-2016-1899 external
https://bugzilla.suse.com/961916 external
https://www.suse.com/security/cve/CVE-2016-1900 external
https://bugzilla.suse.com/961916 external
https://www.suse.com/security/cve/CVE-2016-1901 external
https://bugzilla.suse.com/961916 external
https://www.suse.com/security/cve/CVE-2016-2315 external
https://bugzilla.suse.com/971328 external
https://www.suse.com/security/cve/CVE-2016-2324 external
https://bugzilla.suse.com/971328 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "cgit-1.0-1.3 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the cgit-1.0-1.3 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-10137",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10137-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2011-2711 page",
        "url": "https://www.suse.com/security/cve/CVE-2011-2711/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2012-4465 page",
        "url": "https://www.suse.com/security/cve/CVE-2012-4465/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2012-4548 page",
        "url": "https://www.suse.com/security/cve/CVE-2012-4548/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2013-2117 page",
        "url": "https://www.suse.com/security/cve/CVE-2013-2117/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-1899 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-1899/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-1900 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-1900/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-1901 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-1901/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2315 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2315/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2016-2324 page",
        "url": "https://www.suse.com/security/cve/CVE-2016-2324/"
      }
    ],
    "title": "cgit-1.0-1.3 on GA media",
    "tracking": {
      "current_release_date": "2026-09-20T19:52:57Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:10137-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-20T19:52:57Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cgit-0:1.0-1.3.aarch64",
                "product": {
                  "name": "cgit-0:1.0-1.3.aarch64",
                  "product_id": "cgit-0:1.0-1.3.aarch64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cgit@1.0-1.3?arch=aarch64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cgit-0:1.0-1.3.ppc64le",
                "product": {
                  "name": "cgit-0:1.0-1.3.ppc64le",
                  "product_id": "cgit-0:1.0-1.3.ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cgit@1.0-1.3?arch=ppc64le"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cgit-0:1.0-1.3.s390x",
                "product": {
                  "name": "cgit-0:1.0-1.3.s390x",
                  "product_id": "cgit-0:1.0-1.3.s390x",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cgit@1.0-1.3?arch=s390x"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cgit-0:1.0-1.3.x86_64",
                "product": {
                  "name": "cgit-0:1.0-1.3.x86_64",
                  "product_id": "cgit-0:1.0-1.3.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/cgit@1.0-1.3?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cgit-0:1.0-1.3.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64"
        },
        "product_reference": "cgit-0:1.0-1.3.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cgit-0:1.0-1.3.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le"
        },
        "product_reference": "cgit-0:1.0-1.3.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cgit-0:1.0-1.3.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x"
        },
        "product_reference": "cgit-0:1.0-1.3.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cgit-0:1.0-1.3.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
        },
        "product_reference": "cgit-0:1.0-1.3.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2011-2711",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2011-2711"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Cross-site scripting (XSS) vulnerability in the print_fileinfo function in ui-diff.c in cgit 0.9.0.2 and earlier allows remote authenticated users to inject arbitrary web script or HTML via the filename associated with the rename hint.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2011-2711",
          "url": "https://www.suse.com/security/cve/CVE-2011-2711"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 707929 for CVE-2011-2711",
          "url": "https://bugzilla.suse.com/707929"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2011-2711"
    },
    {
      "cve": "CVE-2012-4465",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2012-4465"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the \"Author\" field in a commit.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2012-4465",
          "url": "https://www.suse.com/security/cve/CVE-2012-4465"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 783012 for CVE-2012-4465",
          "url": "https://bugzilla.suse.com/783012"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2012-4465"
    },
    {
      "cve": "CVE-2012-4548",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2012-4548"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Argument injection vulnerability in syntax-highlighting.sh in cgit 9.0.3 and earlier allows remote authenticated users with permissions to add files to execute arbitrary commands via the --plug-in argument to the highlight command.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2012-4548",
          "url": "https://www.suse.com/security/cve/CVE-2012-4548"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 787074 for CVE-2012-4548",
          "url": "https://bugzilla.suse.com/787074"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2012-4548"
    },
    {
      "cve": "CVE-2013-2117",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2013-2117"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Directory traversal vulnerability in the cgit_parse_readme function in ui-summary.c in cgit before 0.9.2, when a readme file is set to a filesystem path, allows remote attackers to read arbitrary files via a .. (dot dot) in the url parameter.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2013-2117",
          "url": "https://www.suse.com/security/cve/CVE-2013-2117"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 822166 for CVE-2013-2117",
          "url": "https://bugzilla.suse.com/822166"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2013-2117"
    },
    {
      "cve": "CVE-2016-1899",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-1899"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via CRLF sequences in the mimetype parameter, as demonstrated by a request to blob/cgit.c.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-1899",
          "url": "https://www.suse.com/security/cve/CVE-2016-1899"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 961916 for CVE-2016-1899",
          "url": "https://bugzilla.suse.com/961916"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-1899"
    },
    {
      "cve": "CVE-2016-1900",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-1900"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permission to write to a repository to inject arbitrary HTTP headers and conduct HTTP response splitting attacks or cross-site scripting (XSS) attacks via newline characters in a filename.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-1900",
          "url": "https://www.suse.com/security/cve/CVE-2016-1900"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 961916 for CVE-2016-1900",
          "url": "https://bugzilla.suse.com/961916"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-1900"
    },
    {
      "cve": "CVE-2016-1901",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-1901"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Integer overflow in the authenticate_post function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header, which triggers a buffer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-1901",
          "url": "https://www.suse.com/security/cve/CVE-2016-1901"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 961916 for CVE-2016-1901",
          "url": "https://bugzilla.suse.com/961916"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-1901"
    },
    {
      "cve": "CVE-2016-2315",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2315"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2315",
          "url": "https://www.suse.com/security/cve/CVE-2016-2315"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 971328 for CVE-2016-2315",
          "url": "https://bugzilla.suse.com/971328"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-2315"
    },
    {
      "cve": "CVE-2016-2324",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2016-2324"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
          "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2016-2324",
          "url": "https://www.suse.com/security/cve/CVE-2016-2324"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 971328 for CVE-2016-2324",
          "url": "https://bugzilla.suse.com/971328"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.aarch64",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.ppc64le",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.s390x",
            "openSUSE Tumbleweed:cgit-0:1.0-1.3.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2016-2324"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.