CVE-2016-1901

9.8 CRITICAL

Published: January 20, 2016 Modified: May 06, 2026

Description

Integer overflow in the authenticate_post function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header, which triggers a buffer overflow.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://git.zx2c4.com/cgit/commit/?id=4458abf64172a62b92810c2293450106e6dfc763

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176167.html

Source: cve@mitre.org

http://lists.fedoraproject.org/pipermail/package-announce/2016-January/176198.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2016-01/msg00067.html

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-updates/2016-01/msg00084.html

Source: cve@mitre.org

http://lists.zx2c4.com/pipermail/cgit/2016-January/002817.html

Source: cve@mitre.org

Patch

http://www.debian.org/security/2016/dsa-3545

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2016/01/14/3

Source: cve@mitre.org

Exploit

http://www.openwall.com/lists/oss-security/2016/01/14/6

Source: cve@mitre.org

Patch

http://git.zx2c4.com/cgit/commit/?id=4458abf64172a62b92810c2293450106e6dfc763