GCVE - cpe:2.3:a:libgit2_project:libgit2:0.25.0:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:libgit2_project:libgit2:0.25.0:*:*:*:*:*:*:*

part: a version: 0.25.0 update: *

Vendor	Libgit2 Project (`6fe300a9-ad1a-5830-ba53-68e6f27e4d84`)
Product	Libgit2 (`6c0b3d64-52be-5bec-998d-00a8335bae25`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*

Notes

Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:bitbucket/evzijst/libgit2`	purl2cpe	2026-06-01 10:18:04.909758
`pkg:deb/debian/libgit2-1.5`	purl2cpe	2026-06-01 10:18:04.909760
`pkg:deb/ubuntu/libgit2-1.5`	purl2cpe	2026-06-01 10:18:04.909762
`pkg:github/libgit2/libgit2`	purl2cpe	2026-06-01 10:18:04.909763
`pkg:gitlab/gitlab-org/libgit2`	purl2cpe	2026-06-01 10:18:04.909764
`pkg:golang/github.com/libgit2/libgit2`	purl2cpe	2026-06-01 10:18:04.909766
`pkg:rpm/fedora/libgit2`	purl2cpe	2026-06-01 10:18:04.909767
`pkg:rpm/opensuse/libgit2`	purl2cpe	2026-06-01 10:18:04.909769
`pkg:sourceforge/libgit2.mirror`	purl2cpe	2026-06-01 10:18:04.909770

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2016-10130`	vulnerable	2026-06-08 05:07:17.384410	Details available The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable. Published: 2017-03-24T15:00:00.000Z Updated: 2024-08-06T03:14:41.339Z Open on db.gcve.eu Reference links https://libgit2.github.com/security/ http://www.openwall.com/lists/oss-security/2017/01/10/5 http://www.openwall.com/lists/oss-security/2017/01/11/6 http://www.securityfocus.com/bid/95359 https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10129`	vulnerable	2026-06-08 05:07:17.383865	Details available The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line. Published: 2017-03-24T15:00:00.000Z Updated: 2024-08-06T03:14:41.323Z Open on db.gcve.eu Reference links https://libgit2.github.com/security/ https://github.com/libgit2/libgit2/commit/2fdef641fd0dd2828bd948234ae86de75221a11a https://github.com/libgit2/libgit2/commit/84d30d569ada986f3eef527cbdb932643c2dd037 http://www.openwall.com/lists/oss-security/2017/01/10/5 http://www.openwall.com/lists/oss-security/2017/01/11/6	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2016-10128`	vulnerable	2026-06-08 05:07:17.381866	Details available Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet. Published: 2017-03-24T15:00:00.000Z Updated: 2024-08-06T03:14:42.380Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/95338 https://libgit2.github.com/security/ https://github.com/libgit2/libgit2/commit/66e3774d279672ee51c3b54545a79d20d1ada834 https://github.com/libgit2/libgit2/commit/4ac39c76c0153d1ee6889a0984c39e97731684b2 http://www.openwall.com/lists/oss-security/2017/01/10/5	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.

Libgit2

Notes

PURL mappings

Vulnerability references

Contribute