CVE-2018-10887
- State
- Published
- Severity
- Not scored
- Published
- Jul 10, 2018
- Updated
- Sep 17, 2024
- Reserved
- May 9, 2018
Description
A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.
Scores
The record has no CVSS score.
Weaknesses
- CWE-194 >CWE-190->CWE-125
Affected Products
| Product | Versions |
|---|---|
libgit2libgit2 |
|
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1598021
- [debian-lts-announce] 20180825 [SECURITY] [DLA 1477-1] libgit2 security updatemailing-list
- https://github.com/libgit2/libgit2/releases/tag/v0.27.3
- https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22
- https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a
- [debian-lts-announce] 20220321 [SECURITY] [DLA 2936-1] libgit2 security updatemailing-list
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.