CVE-2018-15501
Fixed in a distro release EPSS 4%
In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS.
Products: debian_linux, libgit2
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | libgit2 | 0.27.4-r0 |
| Alpine 3.11 | libgit2 | 0.27.4-r0 |
| Alpine 3.9 | libgit2 | 0.27.4-r0 |
| Debian 12 | libgit2 | 0.27.4+dfsg.1-0.1 |
| Debian 13 | libgit2 | 0.27.4+dfsg.1-0.1 |
| Debian 14 | libgit2 | 0.27.4+dfsg.1-0.1 |
| Debian 8 | libgit2 | 0.21.1-3+deb8u1 |
| Debian 9 | libgit2 | 0.25.1+really0.24.6-1+deb9u1 |
| SUSE Linux Enterprise Module for Development Tools 15 | libgit2 | 0.26.6-3.5.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libgit2 | 0.24.1-7.6.1 |
| SUSE Manager Server 3.1 | libgit2 | 0.24.1-7.6.1 |
| SUSE Manager Server 3.2 | libgit2 | 0.24.1-7.6.1 |
| Ubuntu 24.04 LTS | libgit2 | 1.7.2+ds-1ubuntu3.1 |
| Ubuntu 26.04 LTS | libgit2 | 1.9.1+ds-1ubuntu1.1 |
| Ubuntu Pro 14.04 LTS | libgit2 | 0.19.0-2ubuntu0.4+esm2 |
| Ubuntu Pro 16.04 LTS | libgit2 | 0.24.1-2ubuntu0.2+esm3 |
| Ubuntu Pro 18.04 LTS | libgit2 | 0.26.0+dfsg.1-1.1ubuntu0.2+esm2 |
| Ubuntu Pro 20.04 LTS | libgit2 | 0.28.4+dfsg.1-2ubuntu0.1+esm1 |
| Ubuntu Pro 22.04 LTS | libgit2 | 1.1.0+dfsg.1-4.1ubuntu0.1+esm1 |