CVEvulnerability

CVE-2018-10887

8.1 HIGH Published 2018-07-10 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2018-07-10
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.1 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:P
Weaknesses
CWE-125, CWE-190, CWE-194, CWE-681

Description

A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.

Affected configurations

• libgit2 libgit2 (< 0.27.3) • debian debian linux 8.0 • debian debian linux 9.0

Related

Weakness · CWE (4)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-190 Integer Overflow or Wraparound weakness
  • CWE-194 Unexpected Sign Extension weakness
  • CWE-681 Incorrect Conversion between Numeric Types weakness

Referenced by CWE · observed example (3)

  • CWE-125 Out-of-bounds Read weakness
  • CWE-190 Integer Overflow or Wraparound weakness
  • CWE-194 Unexpected Sign Extension weakness

References