CVE-2018-10887
Fixed in a distro release EPSS 2%
A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.
Products: libgit2
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | libgit2 | 0.27.3-r0 |
| Alpine 3.11 | libgit2 | 0.27.3-r0 |
| Alpine 3.8 | libgit2 | 0.27.3-r0 |
| Alpine 3.9 | libgit2 | 0.27.3-r0 |
| Debian 12 | libgit2 | 0.27.4+dfsg.1-0.1 |
| Debian 13 | libgit2 | 0.27.4+dfsg.1-0.1 |
| Debian 14 | libgit2 | 0.27.4+dfsg.1-0.1 |
| Debian 8 | libgit2 | 0.21.1-3+deb8u1 |
| Debian 9 | libgit2 | 0.25.1+really0.24.6-1+deb9u1 |
| SUSE Linux Enterprise Module for Development Tools 15 | libgit2 | 0.26.6-3.5.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libgit2 | 0.24.1-7.6.1 |
| SUSE Manager Server 3.1 | libgit2 | 0.24.1-7.6.1 |
| SUSE Manager Server 3.2 | libgit2 | 0.24.1-7.6.1 |
| Ubuntu 14.04 LTS | libgit2 | 0.19.0-2ubuntu0.4 |
| Ubuntu 16.04 LTS | libgit2 | 0.24.1-2ubuntu0.2 |
| Ubuntu 18.04 LTS | libgit2 | 0.26.0+dfsg.1-1.1ubuntu0.2 |
| openSUSE Tumbleweed | libgit2 | 1.1.1-1.2 |