CVE-2015-0838

Advisory

Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

SECURITY BUG FIXES

* Fix buffer overflow in C implementation of pack apply_delta().
(CVE-2015-0838)

Thanks to Ivan Fratric of the Google Security Team for
reporting this issue.
(Jelmer Vernooij)

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0838
• http://www.debian.org/security/2015/dsa-3206
• https://lists.launchpad.net/dulwich-users/msg00829.html