In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote atta...
Summary
CVE-2018-15501: In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to... Affects libgit2 across 4 version ranges.
< 0.27.4-r0
< 1f9a8510e1d2f20ed7334eeeddb92c4dd8e7c649
< 8b89f362a34fcccdf1c6c5f3445895b71d9c6d56
< e98d0a37c93574d2c6107bf7f31140b548c6a7bf
Fixed in 0.27.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS.
How To Fix
Minimum fixed version
0.27.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade libgit2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
