PT-2018-3955 · Libgit2+2 · Libgit2+2
Riccardo Schirone
·
Publicado
2018-07-09
·
Atualizado
2024-06-15
·
CVE-2018-10887
CVSS v2.0
9.4
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:C |
Name of the Vulnerable Software and Affected Versions
libgit2 versions prior to 0.27.3
Description
The issue is related to the
git delta apply function in the delta.c component of libgit2, which is used for Git implementation in C. It involves an out of bound read due to an unexpected sign extension, potentially leading to an integer overflow. This could allow a remote attacker to access confidential data or cause a Denial of Service, possibly leaking memory addresses.Recommendations
For versions prior to 0.27.3, update to version 0.27.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the
git delta apply function until a patch is available.Exploit
Correção
DoS
Out of bounds Read
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Alt Linux
Suse
Libgit2