CVE-2018-10888 — Improper Input Validation in Libgit2

CWE-20 — Improper Input ValidationCWE-125 — Out-of-bounds Read6 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.4%
top 38.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Libgit2Debian Libgit2Debian Linux
Timeline
PublishedJul 10
Latest updateMay 13

Description

A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to cause a Denial of Service.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/libgit2< libgit2 0.27.4+dfsg.1-0.1 (bookworm)
▶NVDlibgit2/libgit2< 0.27.3
▶Debianlibgit2/libgit2< 0.27.4+dfsg.1-0.1+3
▶CVEListV5libgit2/libgit2before version 0.27.3

Also affects: Debian Linux 8.0, 9.0

Patches

Patch: bugzilla.redhat.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-mwfj-cw48-q48m: A flaw was found in libgit2 before version 0↗2022-05-13
▶
OSV
CVE-2018-10888: A flaw was found in libgit2 before version 0↗2018-07-10
▶

📋Vendor Advisories

1
Debian
CVE-2018-10888: libgit2 - A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-10888 libgit2: an improper input validation leads to an out-of-bound read in git_delta_apply, allowing to read beyond delta limits [fedora-all]↗2018-07-09
▶
Bugzilla
CVE-2018-10888 libgit2: an improper input validation leads to an out-of-bound read in git_delta_apply, allowing to read beyond delta limits↗2018-07-04
▶