Updated libgit2 package fixes security vulnerabilities
Publication date: 30 Oct 2026Modification date: 30 Oct 2026
Type: security
Affected Mageia releases : 10
CVE: CVE-2026-53583 , CVE-2026-53584 , CVE-2026-53585 , CVE-2026-53586 , CVE-2026-53587 , CVE-2026-5917
Description
Inverted IP SubjectAltName Comparison in OpenSSL Backend.
(CVE-2026-53583)
Submodule path traversal. (CVE-2026-53584)
Unbounded Memory Allocation via Delta Object Result-Size Header.
(CVE-2026-53585)
HTTP transport can leak credentials to an offsite redirect target.
(CVE-2026-53586)
Unauthenticated network-reachable heap out-of-bounds read in
transports/smart_pkt.c:set_data. (CVE-2026-53587)
Shell Command Injection via ssh_libssh2 Backend. (CVE-2026-5917)
References
- https://bugs.mageia.org/show_bug.cgi?id=35993
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/VHH635RSSSNGD55XOG7MSUBAC6CK77E2/
- https://www.openwall.com/lists/oss-security/2026/08/20/4
- https://ubuntu.com/security/notices/USN-8628-1
- https://lists.debian.org/debian-security-announce/2026/msg00364.html
- https://www.cve.org/CVERecord?id=CVE-2026-53583
- https://www.cve.org/CVERecord?id=CVE-2026-53584
- https://www.cve.org/CVERecord?id=CVE-2026-53585
- https://www.cve.org/CVERecord?id=CVE-2026-53586
- https://www.cve.org/CVERecord?id=CVE-2026-53587
- https://www.cve.org/CVERecord?id=CVE-2026-5917
SRPMS
10/core
- libgit2-1.9.2-1.1.mga10