CVE-2016-2090

What it actually does

Off-by-one error in fgetwln triggers a heap-based buffer overflow, enabling out-of-bounds memory writes and potential arbitrary code execution.

Why it matters to the business

Services relying on the affected library versions, including Git hosting platforms, face risk of remote compromise that can lead to data theft, service disruption, or supply-chain attacks across dependent environments.

How an attack unfolds

An attacker supplies crafted input that exercises the vulnerable fgetwln path, overflows the heap buffer, and gains control of execution flow to execute arbitrary code on the target system.

How to fix it

Upgrade libbsd to 0.8.2 or later. For listed products apply the exact fixes: gitlab (Bitnami) to 13.12.9 and om/cgit (GIT) to commit 8cc02871230aef457006ac775dd1cca5623516a9.

How to confirm the fix worked

Confirm the installed libbsd version is at least 0.8.2, verify product binaries reference the corrected commit, and re-run any unit tests that exercise fgetwln.

Typical attack path

1. Identify a network-reachable service using the vulnerable library
2. Craft and send input sized to trigger the off-by-one condition
3. Overwrite adjacent heap structures to achieve code execution
4. Establish persistence or exfiltrate data from the compromised process

How to detect it

Review process memory dumps and crash logs for repeated heap corruption patterns around line-buffered input handling; correlate with network logs showing unusual request sizes to services built on the vulnerable library.

What your security team should do

• Prioritize patching internet-facing instances of affected Git services within 30 days
• Add the library to the organization's software bill of materials and dependency scanning policy
• Monitor upstream advisories for any newly published proof-of-concept code