CVE-2018-8099
Fixed in a distro release EPSS 1%
Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository index file.
Products: libgit2, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | libgit2 | 0.27.0+dfsg.1-0.6 |
| Debian 13 | libgit2 | 0.27.0+dfsg.1-0.6 |
| Debian 14 | libgit2 | 0.27.0+dfsg.1-0.6 |
| Debian 9 | libgit2 | 0.25.1+really0.24.6-1+deb9u1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | libgit2 | 0.24.1-7.6.1 |
| SUSE Manager Server 3.1 | libgit2 | 0.24.1-7.6.1 |
| SUSE Manager Server 3.2 | libgit2 | 0.24.1-7.6.1 |
| Ubuntu 24.04 LTS | libgit2 | 1.7.2+ds-1ubuntu3.1 |
| Ubuntu 26.04 LTS | libgit2 | 1.9.1+ds-1ubuntu1.1 |
| Ubuntu Pro 14.04 LTS | libgit2 | 0.19.0-2ubuntu0.4+esm2 |
| Ubuntu Pro 16.04 LTS | libgit2 | 0.24.1-2ubuntu0.2+esm3 |
| Ubuntu Pro 18.04 LTS | libgit2 | 0.26.0+dfsg.1-1.1ubuntu0.2+esm2 |
| Ubuntu Pro 20.04 LTS | libgit2 | 0.28.4+dfsg.1-2ubuntu0.1+esm1 |
| Ubuntu Pro 22.04 LTS | libgit2 | 1.1.0+dfsg.1-4.1ubuntu0.1+esm1 |