CVE-2016-8568: Fedoraproject Fedora

Medium severity, CVSS 5.5. EPSS: 1.9% chance of exploitation in the next 30 days.

The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file.

Affected products

• Fedoraproject Fedora: version 23 only; version 24 only; version 25 only
• LIBGIT2 Project LIBGIT2: up to and including 0.24.2
• Opensuse Leap: version 42.1 only; version 42.2 only
• Opensuse Opensuse: version 13.2 only
• Suse Linux Enterprise: version 12.0 only

Published 2017-02-03. Last modified 2026-06-17.