FreeBSD : git -- multiple vulnerabilities (24e1443d-dd3b-11f1-b094-bc2411e144f8)

high Nessus Plugin ID 378782

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 24e1443d-dd3b-11f1-b094-bc2411e144f8 advisory.

Git development team reports:
CVE-2026-111760:
Recursive clones are susceptible to Remote Code Execution: an attacker-controlled repository can be crafted in a way that exploits a bug in Git whereby Git can be fooled into overwriting a gitfile (used for submodules) with a symbolic link that then points to a directory with malicious config or hooks. The config or hooks may have attacker-specified code.

CVE-2026-113408:
It is possible for a server to advertise an unborn HEAD that contains path-traversal characters (e.g., `refs/heads/../../../TARGET`). With the files ref backend that can lead to ref-updating actions to write to unwanted files.

CVE-2026-114466:
In response to CVE-2019-1348, `fast-import` disallows the `export-marks` feature by default. The features `rewrite-submodules-to` and `rewrite-submodules-from` as well as the option `export-pack-edges` that were introduced in the meantime also allow reading from arbitrary paths, and are therefore now also disallowed by default.

CVE-2026-114467:
When Git strips the GPG signatures from a commit message, it only accounts for two signatures. A commit message containing more than two signatures therefore causes a stack memory corruption.
This can be triggered when using `git merge` with a tag which contains more than two signatures, making way for a DoS attack which can potentially also affect forges.

CVE-2026-114469:
Git rejects patches larger than ~1 GiB, but that check only considered the size of the patch as it appears in the input, which for binary patches is much smaller than the size of the file the patch describes. A binary patch that inflates to a very large size therefore slipped past the check and crashed Git with an out-of-bounds read.

CVE-2026-105437:
When merging, Git computes the size of the buffer holding the merge result in a way that can overflow for very large merges, which can be triggered by a large number of conflicts combined with a large `conflict-marker-size`. The resulting buffer can then be too small, and Git writes past its end (and, before and after that, before its start), corrupting the heap.

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 378782

File Name: freebsd_pkg_24e1443ddd3b11f1b094bc2411e144f8.nasl

Version: 1.1

Type: Local

Family: FreeBSD Local Security Checks

Published: 11/11/2026

Updated: 11/11/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.32

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 5.6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-105437

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.5

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:freebsd:freebsd, p-cpe:/a:freebsd:freebsd:git-cvs, p-cpe:/a:freebsd:freebsd:git-gui, p-cpe:/a:freebsd:freebsd:git-lite, p-cpe:/a:freebsd:freebsd:git-p4, p-cpe:/a:freebsd:freebsd:git-svn, p-cpe:/a:freebsd:freebsd:git-tiny, p-cpe:/a:freebsd:freebsd:git

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Ease: No known exploits are available

Patch Publication Date: 11/10/2026

Vulnerability Publication Date: 11/10/2026

Reference Information

CVE: CVE-2026-105437, CVE-2026-111760, CVE-2026-113408, CVE-2026-114466, CVE-2026-114467, CVE-2026-114469

Detections

Analytics