CVE-2018-10887
High
Description
A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Libgit2
PublishedJul 10, 2018
First seenJul 10, 2018
Weakness typeCWE-194CWE-194
How to fix
Update
- libgit2 libgit20.27.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| libgit2 libgit2 | v < 0.27.3 | 0.27.3 |
| debian debian_linux | 8.0, 9.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.