CVE - CVE-2012-4465

CVE-ID
CVE-2012-4465	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:50734 URL:http://secunia.com/advisories/50734 MISC:55724 URL:http://www.securityfocus.com/bid/55724 MISC:[cgit] 20120703 avoid stack-smash when processing unusual commit URL:http://hjemli.net/pipermail/cgit/2012-July/000652.html MISC:[oss-security] 20120930 cgit: heap buffer overflow URL:http://www.openwall.com/lists/oss-security/2012/09/30/1 MISC:[oss-security] 20121003 Re: cgit: heap buffer overflow URL:http://www.openwall.com/lists/oss-security/2012/10/03/7 MISC:http://git.zx2c4.com/cgit/commit/?id=7757d1b046ecb67b830151d20715c658867df1ec URL:http://git.zx2c4.com/cgit/commit/?id=7757d1b046ecb67b830151d20715c658867df1ec MISC:https://bugzilla.redhat.com/show_bug.cgi?id=820733 URL:https://bugzilla.redhat.com/show_bug.cgi?id=820733
Assigning CNA
Red Hat, Inc.
Date Record Created
20120821	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20120821)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)