A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign
    extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads
    to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak
    memory addresses or cause a Denial of Service. (CVE-2018-10887)

  - A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c
    file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to
    cause a Denial of Service. (CVE-2018-10888)

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2936 advisory.

    Multiple vulnerabilities were found in libgit2, a low-level Git library, and are as follows: CVE-2018-8098     Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in     libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted     repository index file. CVE-2018-8099 Incorrect returning of an error code in the index.c:read_entry()     function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of     service via a crafted repository index file. CVE-2018-10887 It has been discovered that an unexpected sign     extension in git_delta_apply function in delta-apply.c file may lead to an integer overflow which in turn     leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to     leak memory addresses or cause a Denial of Service. CVE-2018-10888 A missing check in git_delta_apply     function in delta-apply.c file, may lead to an out-of-bound read while reading a binary delta file. An     attacker may use this flaw to cause a Denial of Service. CVE-2018-15501 In ng_pkt in     transports/smart_pkt.c in libgit2, a remote attacker can send a crafted smart-protocol ng packet that     lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS. CVE-2020-12278 path.c mishandles     equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow remote code     execution when cloning a repository. This issue is similar to CVE-2019-1352. CVE-2020-12279 checkout.c     mishandles equivalent filenames that exist because of NTFS short names. This may allow remote code     execution when cloning a repository. This issue is similar to CVE-2019-1353. For Debian 9 stretch, these     problems have been fixed in version 0.25.1+really0.24.6-1+deb9u1. We recommend that you upgrade your     libgit2 packages. For the detailed security status of libgit2 please refer to its security tracker page     at: https://security-tracker.debian.org/tracker/libgit2 Further information about Debian LTS security     advisories, how to apply these updates to your system and frequently asked questions can be found at:
    https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libgit2 to version 0.26.5 fixes the following issues :

The following security vulnerabilities were addressed :

  - CVE-2018-10887: Fixed an integer overflow which in turn     leads to an out of bound read, allowing to read the base     object, which could be exploited by an attacker to cause     denial of service (DoS) (bsc#1100613).

  - CVE-2018-10888: Fixed an out-of-bound read while reading     a binary delta file, which could be exploited by an     attacker t ocause a denial of service (DoS)     (bsc#1100612).

  - CVE-2018-11235: Fixed a remote code execution, which     could occur with a crafted .gitmodules file     (bsc#1095219)

  - CVE-2018-15501: Prevent out-of-bounds reads when     processing smart-protocol 'ng' packets (bsc#1104641)

This update was imported from the SUSE:SLE-15:Update update project.

Update to 0.26.5 (CVE-2018-10887, CVE-2018-10888)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgit2 to version 0.26.5 fixes the following issues:
The following security vulnerabilities were addressed :

  - CVE-2018-10887: Fixed an integer overflow which in turn     leads to an out of bound read, allowing to read the base     object, which could be exploited by an attacker to cause     denial of service (DoS) (bsc#1100613).

  - CVE-2018-10888: Fixed an out-of-bound read while reading     a binary delta file, which could be exploited by an     attacker t ocause a denial of service (DoS)     (bsc#1100612).

  - CVE-2018-11235: Fixed a remote code execution, which     could occur with a crafted .gitmodules file     (bsc#1095219)

  - CVE-2018-15501: Prevent out-of-bounds reads when     processing smart-protocol 'ng' packets (bsc#1104641)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgit2 fixes the following issues :

  - CVE-2018-8099: Fixed possible denial of service attack     via different vectors by not being able to differentiate     between these status codes (bsc#1085256).

  - CVE-2018-11235: With a crafted .gitmodules file, a     malicious project can execute an arbitrary script on a     machine that runs 'git clone --recurse-submodules'     because submodule 'names' are obtained from this file,     and then appended to $GIT_DIR/modules, leading to     directory traversal with '../' in a name. Finally,     post-checkout hooks from a submodule are executed,     bypassing the intended design in which hooks are not     obtained from a remote server. (bsc#1095219)

  - CVE-2018-10887: It has been discovered that an     unexpected sign extension in git_delta_apply function in     delta.c file may have lead to an integer overflow which     in turn leads to an out of bound read, allowing to read     before the base object. An attacker could have used this     flaw to leak memory addresses or cause a Denial of     Service. (bsc#1100613)

  - CVE-2018-10888: A missing check in git_delta_apply     function in delta.c file, may lead to an out-of-bound     read while reading a binary delta file. An attacker may     use this flaw to cause a Denial of Service.
    (bsc#1100612)

  - CVE-2018-15501: A remote attacker can send a crafted     smart-protocol 'ng' packet that lacks a '\0' byte to     trigger an out-of-bounds read that leads to DoS.
    (bsc#1104641)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

CVE-2018-15501 A potential out-of-bounds read when processing a 'ng' smart packet might lead to a Denial of Service.

CVE-2018-10887 A flaw has been discovered that may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. This might be used to leak memory addresses or cause a Denial of Service.

CVE-2018-10888 A flaw may lead to an out-of-bound read while reading a binary delta file. This might result in a Denial of Service.

For Debian 8 'Jessie', these problems have been fixed in version 0.21.1-3+deb8u1.

We recommend that you upgrade your libgit2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The Git community reports :

Out-of-bounds reads when reading objects from a packfile

ID	Name	Product	Family	Severity
405193	Alpine: libgit2-1.1: security update to 0.27.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405193	Alpine: libgit2-1.1: security update to 0.27.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
405188	Alpine: libgit2-1.0: security update to 0.27.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405188	Alpine: libgit2-1.0: security update to 0.27.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
405183	Alpine: multiple libgit2 packages: security update to 0.27.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405183	Alpine: multiple libgit2 packages: security update to 0.27.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
405181	Alpine: libgit2-0.27: security update to 0.27.3-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	high
405181	Alpine: libgit2-0.27: security update to 0.27.3-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
400680	Alpine: multiple libgit2 packages: security update to 0.27.2-r0 (deprecated)	Tenable Cloud Security	Alpine Linux Local Security Checks	high
400680	Alpine: multiple libgit2 packages: security update to 0.27.2-r0 (deprecated)	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	high
159090	Debian DLA-2936-1 : libgit2 - LTS security update	Nessus	Debian Local Security Checks	critical
123276	openSUSE Security Update : libgit2 (openSUSE-2019-638)	Nessus	SuSE Local Security Checks	high
120404	Fedora 28 : libgit2 (2018-4d253dc945)	Nessus	Fedora Local Security Checks	high
120086	SUSE SLED15 / SLES15 Security Update : libgit2 (SUSE-SU-2018:2469-1)	Nessus	SuSE Local Security Checks	high
118486	openSUSE Security Update : libgit2 (openSUSE-2018-1314)	Nessus	SuSE Local Security Checks	high
112139	openSUSE Security Update : libgit2 (openSUSE-2018-922)	Nessus	SuSE Local Security Checks	high
112126	Debian DLA-1477-1 : libgit2 security update	Nessus	Debian Local Security Checks	high
111250	Fedora 27 : libgit2 (2018-fb071377ba)	Nessus	Fedora Local Security Checks	high
111019	FreeBSD : Libgit2 -- multiple vulnerabilities (3c9b7698-84da-11e8-8c75-d8cb8abf62dd)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-10887

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

critical

high

high

high

high

high

high

high

high