CVE:CVE-2012-4465
CNNVD:CNNVD-201210-177
cgit 0.9.0.3及更早版本中的parsing.c中的substr功能中存在堆溢出漏洞。通过在“Author”字段中提交空的用户名，远程认证攻击者可利用该漏洞导致拒绝服务（死机）和执行任意代码。
solution:Upgrade lars_hjemli cgit to a higher version than 0.9.0.3,0.1,0.2,0.3,0.4,0.5,0.6,0.6.1,0.6.2,0.6.3,0.7,0.7.1,0.7.2,0.8,0.8.1,0.8.1.1,0.8.2,0.8.2.1,0.8.2.2,0.8.3,0.8.3.1,0.8.3.2,0.8.3.3,0.8.3.4,0.8.3.5,0.9,0.9.0.1,0.9.0.2,and avoid the version (,0.9.0.3],0.1,0.2,0.3,0.4,0.5,0.6,0.6.1,0.6.2,0.6.3,0.7,0.7.1,0.7.2,0.8,0.8.1,0.8.1.1,0.8.2,0.8.2.1,0.8.2.2,0.8.3,0.8.3.1,0.8.3.2,0.8.3.3,0.8.3.4,0.8.3.5,0.9,0.9.0.1,0.9.0.2