Description
In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6Attack Vector: Network
Complexity: Low
Privileges: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None
Affected Packages2 packages
Also affects: Ubuntu Linux 14.04, 16.04, 17.10, 18.04
🔴Vulnerability Details
4GHSAGHSA-f2cx-gr8r-v8wf: In Git before 2↗2022-05-13 OSVgit vulnerabilities↗2018-06-05 CVEListCVE-2018-11233: In Git before 2↗2018-05-30 OSVCVE-2018-11233: In Git before 2↗2018-05-30 📋Vendor Advisories
4AppleCVE-2018-11233: Xcode 9.4.1↗2018-06-13 UbuntuGit vulnerabilities↗2018-06-05 Red Hatgit: path sanity check in is_ntfs_dotgit() can read arbitrary memory↗2018-05-30 DebianCVE-2018-11233: git - In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before ...↗2018 💬Community
2BugzillaCVE-2018-11233 git: path sanity-checks on NTFS can read arbitrary memory [fedora-all]↗2018-05-30 BugzillaCVE-2018-11233 git: path sanity check in is_ntfs_dotgit() can read arbitrary memory↗2018-05-30