Debian Libgit2 vulnerabilities

CVE-2024-24577 [HIGH] CVE-2024-24577: libgit2 - libgit2 is a portable C implementation of the Git core methods provided as a lin... libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c

CVE-2024-24575 [HIGH] CVE-2024-24575: libgit2 - libgit2 is a portable C implementation of the Git core methods provided as a lin... libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_revparse_single` can cause the function to enter an infinite loop, potentially causing a Denial of Service attack in the calling application. The revparse function

CVE-2023-22742 [MEDIUM] CVE-2023-22742: libgit2 - libgit2 is a cross-platform, linkable library implementation of Git. When using ... libgit2 is a cross-platform, linkable library implementation of Git. When using an SSH remote with the optional libssh2 backend, libgit2 does not perform certificate checking by default. Prior versions of libgit2 require the caller to set the `certificate_check` field of libgit2's `git_remote_callbacks` structure - if a certificate check callback is not set, libgi

CVE-2020-12279 [CRITICAL] CVE-2020-12279: libgit2 - An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkou... An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1353. Scope: local bookworm: resolved (fixed in 0.28.4+dfsg.1-2) bullseye: resolved (fixed in 0.28.4+dfsg.1-2)

CVE-2020-12278 [HIGH] CVE-2020-12278: libgit2 - An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c ... An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when cloning a repository. This issue is similar to CVE-2019-1352. Scope: local bookworm: resolved (fixed in 0.28.4+dfsg.1-2) bullseye: resolved (fixed in 0.28.4+dfsg.1

CVE-2018-8099 [MEDIUM] CVE-2018-8099: libgit2 - Incorrect returning of an error code in the index.c:read_entry() function leads ... Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository index file. Scope: local bookworm: resolved (fixed in 0.27.0+dfsg.1-0.6) bullseye: resolved (fixed in 0.27.0+dfsg.1-0.6) forky: resolved (fixed in 0.27.0+dfsg.1-0.6)

CVE-2018-8098 [MEDIUM] CVE-2018-8098: libgit2 - Integer overflow in the index.c:read_entry() function while decompressing a comp... Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted repository index file. Scope: local bookworm: resolved (fixed in 0.27.0+dfsg.1-0.6) bullseye: resolved (fixed in 0.27.0+dfsg.1-0.6) forky: resolved (fixed in

CVE-2018-10887 [HIGH] CVE-2018-10887: libgit2 - A flaw was found in libgit2 before version 0.27.3. It has been discovered that a... A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service. Scope: local

CVE-2018-10888 [MEDIUM] CVE-2018-10888: libgit2 - A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_... A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to cause a Denial of Service. Scope: local bookworm: resolved (fixed in 0.27.4+dfsg.1-0.1) bullseye: resolved (fixed in 0.27.4+dfsg.1-0.1) forky: resolved (

CVE-2018-15501 [HIGH] CVE-2018-15501: libgit2 - In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0... In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS. Scope: local bookworm: resolved (fixed in 0.27.4+dfsg.1-0.1) bullseye: resolved (fixed in 0.27.4+dfsg.1-0.1) forky: resolved (fixed in 0.27.4+

CVE-2016-10128 [CRITICAL] CVE-2016-10128: cargo - Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in ... Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet. Scope: local bookworm: resolved (fixed in 0.17.0-1) bullseye: resolved (fixed in 0.17.0-1)

CVE-2016-10129 [HIGH] CVE-2016-10129: cargo - The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1... The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet line. Scope: local bookworm: resolved (fixed in 0.17.0-1) bullseye: resolved (fixed in 0.17.0-1)

CVE-2016-10130 [MEDIUM] CVE-2016-10130: cargo - The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25... The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable. Scope: local bookworm: resolved (fixed in 0.17.0-1) bullseye: resolved (fixed in 0.17.0-1)

CVE-2016-8568 [MEDIUM] CVE-2016-8568: cargo - The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote ... The git_commit_message function in oid.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (out-of-bounds read) via a cat-file command with a crafted object file. Scope: local bookworm: resolved (fixed in 0.17.0-1) bullseye: resolved (fixed in 0.17.0-1)

CVE-2016-8569 [MEDIUM] CVE-2016-8569: cargo - The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote att... The git_oid_nfmt function in commit.c in libgit2 before 0.24.3 allows remote attackers to cause a denial of service (NULL pointer dereference) via a cat-file command with a crafted object file. Scope: local bookworm: resolved (fixed in 0.17.0-1) bullseye: resolved (fixed in 0.17.0-1)

CVE-2014-9390 [CRITICAL] CVE-2014-9390: dulwich - Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, ... Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git s