Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9
    allows remote attackers to execute arbitrary code via a crafted pack file. (CVE-2015-0838)

Ivan Fratric of the Google Security Team has found a buffer overflow in the C implementation of the apply_delta() function, used when accessing Git objects in pack files. An attacker could take advantage of this flaw to cause the execution of arbitrary code with the privileges of the user running a Git server or client based on Dulwich.

For the oldoldstable distribution (squeeze), this problem has been fixed in version 0.6.1-1+deb6u1.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

MITRE reports :

Buffer overflow in the C implementation of the apply_delta function in
_pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.

Multiple vulnerabilities have been discovered in Dulwich, a Python implementation of the file formats and protocols used by the Git version control system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2014-9706     It was discovered that Dulwich allows writing to files     under .git/ when checking out working trees. This could     lead to the execution of arbitrary code with the     privileges of the user running an application based on     Dulwich.

  - CVE-2015-0838     Ivan Fratric of the Google Security Team has found a     buffer overflow in the C implementation of the     apply_delta() function, used when accessing Git objects     in pack files. An attacker could take advantage of this     flaw to cause the execution of arbitrary code with the     privileges of the user running a Git server or client     based on Dulwich.

ID	Name	Product	Family	Severity
434910	SCA: security update for dulwich (GHSA-vjjf-3rvg-gv3v)	Tenable Cloud Security	SCA Checks	critical
434910	SCA: security update for dulwich (GHSA-vjjf-3rvg-gv3v)	Tenable Self-Hosted Container Security	SCA Checks	critical
83866	Debian DLA-231-1 : dulwich security update	Nessus	Debian Local Security Checks	high
82894	FreeBSD : Dulwich -- Remote code execution (e426eda9-dae1-11e4-8107-94de806b0af9)	Nessus	FreeBSD Local Security Checks	high
82303	Debian DSA-3206-1 : dulwich - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2015-0838

critical

Tenable Plugins

critical

critical

high

high

high