Debian 9 Stretch DLA-2936-1 Critical: Libgit2 Denial Of Service

CVE-2018-8098

Integer overflow in the index.c:read_entry() function while
decompressing a compressed prefix length in libgit2 before
v0.26.2 allows an attacker to cause a denial of service
(out-of-bounds read) via a crafted repository index file.

CVE-2018-8099

Incorrect returning of an error code in the index.c:read_entry()
function leads to a double free in libgit2 before v0.26.2, which
allows an attacker to cause a denial of service via a crafted
repository index file.

CVE-2018-10887

It has been discovered that an unexpected sign extension in
git_delta_apply function in delta-apply.c file may lead to an
integer overflow which in turn leads to an out of bound read,
allowing to read before the base object. An attacker may use
this flaw to leak memory addresses or cause a Denial of Service.

CVE-2018-10888

A missing check in git_delta_apply function in delta-apply.c file,
may lead to an out-of-bound read while reading a binary delta file.