Merge pull request libgit2#80 from libgit2/cmn/update-security

ethomson · web-flow · commit 4ec9300863b3 · 2018-03-12T10:10:28.000+01:00
Update security with v0.26.1 and v0.26.2 and include security contact
diff --git a/security/index.md b/security/index.md
@@ -7,6 +7,25 @@ layout: default
 Information about security advisories affecting libgit2 and the releases that
 provide resolution.
 
+In case you think to have found a security issue with libgit2, please do not
+open a public issue. Instead, you can report the issue to the private mailing
+list [security@libgit2.org](mailto:security@libgit2.org).
+
+ * **[libgit2 v0.26.2](https://github.com/libgit2/libgit2/releases/tag/v0.26.2)**, March 8th, 2018  
+Fixes memory handling issues when reading crafted repository index files. The
+issues allow for possible denial of service due to allocation of large memory
+and out-of-bound reads.
+
+As the index is never transferred via the network, exploitation requires an
+attacker to have access to the local repository.
+
+ * **[libgit2 v0.26.1](https://github.com/libgit2/libgit2/releases/tag/v0.26.1)**, March 7th, 2018  
+Updates the bundled zlib to 1.2.11. Users who build the bundled zlib are
+vulnerable to security issues in the prior version.
+
+This does not affect you if you rely on a system-installed version of zlib. All
+users of v0.26.0 who use the bundled zlib should upgrade to this release.
+
 * **[libgit2 v0.24.6](https://github.com/libgit2/libgit2/releases/tag/v0.24.6)** and **[libgit2 v0.25.1](https://github.com/libgit2/libgit2/releases/tag/v0.25.1)**, January 9th, 2017  
 Includes two fixes, one performs extra sanitization for some edge cases in
 the Git Smart Protocol which can lead to attempting to parse outside of the
