cgit: three vulnerabilities [LWN.net]

Package(s):

cgit

CVE #(s):

CVE-2016-1899 CVE-2016-1900 CVE-2016-1901

Created:

January 22, 2016

Updated:

April 8, 2016

Description:

From the openSUSE advisory:

- CVE-2016-1899: Reflected Cross Site Scripting and Header Injection in Mimetype Query String
- CVE-2016-1900: Stored Cross Site Scripting and Header Injection in Filename Parameter
- CVE-2016-1901: Integer Overflow resulting in Buffer Overflow

Alerts:

Fedora	FEDORA-2016-e5a5fb196f	cgit	2016-01-26
Fedora	FEDORA-2016-215b507409	cgit	2016-01-26
openSUSE	openSUSE-SU-2016:0218-1	cgit	2016-01-24
openSUSE	openSUSE-SU-2016:0196-1	cgit	2016-01-22
Debian	DSA-3545-1	cgit	2016-04-07
Mageia	MGASA-2016-0047	cgit	2016-02-05