Multiple critical vulnerabilities (CVE-2026-5917, CVSS 9.6, and others) in libgit2 could lead to remote command execution on SSH servers, credential disclosure, denial of service, or arbitrary directory creation. For Debian stable (trixie), these issues are fixed in libgit2 version 1.9.0+ds-2+deb13u1. Users should upgrade their libgit2 packages immediately.
[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index] [SECURITY] [DSA 6453-1] libgit2 security update To: debian-security-announce@lists.debian.org Subject: [SECURITY] [DSA 6453-1] libgit2 security update From: Aron Xu <aron@debian.org> Date: Thu, 20 Aug 2026 14:34:10 +0000 Message-id: <[🔎] E1wx3qM-00000006kVy-34cF@seger.debian.org> Reply-to: debian-security-announce-request@lists.debian.org -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian Security Advisory DSA-6453-1 security@debian.org https://www.debian.org/security/ Aron Xu August 20, 2026 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : libgit2 CVE ID : CVE-2026-5917 CVE-2026-53583 CVE-2026-53584 CVE-2026-53585 CVE-2026-53586 CVE-2026-53587 Debian Bug : 1144465 Multiple security issues were discovered in libgit2, a low-level Git library, which could result in the execution of arbitrary commands on a remote SSH server, disclosure of credentials, denial of service or the creation of directories outside a repository's working tree. For the stable distribution (trixie), these problems have been fixed in version 1.9.0+ds-2+deb13u1. We recommend that you upgrade your libgit2 packages. For the detailed security status of libgit2 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libgit2 Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: debian-security-announce@lists.debian.org -----BEGIN PGP SIGNATURE----- iQEzBAEBCAAdFiEExq6D0hxncEPaPayX+GQ1dHE8m64FAmqHDZkACgkQ+GQ1dHE8 m64e4AgAzD+GoC2vblP+SIEwrHecdMqXGC8PyzybdPahVryGqDxAn4Ay8tvy2GCj 2PDCoJEVXNsDnQqW6BS7Wysp5i/ISiguPBOPl68ENvECLOqKgdmdkvcF2ZZZBYov ZsMEM6qlnznWuG7OpU0UgYz7/2lVlj5e1g8VmydURKXbqjJ0/AwRq/Sii+tWTkCr 3lMyPMF6tmd1zb0OWJKR1bEJUJv7TbvQal6FkuoqbFI+HGCibVZY1MJbszrgUQKp 29vgKx/XWZG6TsPgq1+5LtMJhJn0PEVgue7WHeAfU7IyKT4QmaiYgxvOx2/OfXMs uBm9lbMPPaN4HnE9/IQag0WHtDgyXw== =RZDr -----END PGP SIGNATURE----- Reply to: debian-security-announce@lists.debian.org Aron Xu (on-list) Aron Xu (off-list) Prev by Date: [SECURITY] [DSA 6452-1] designate security update Previous by thread: [SECURITY] [DSA 6452-1] designate security update Index(es): Date Thread