Heap-buffer-overflow in libgit2: git__strntol64
Summary
OSV-2018-104: Heap-buffer-overflow in git__strntol64. Affects libgit2 versions >= 7fafec0e53f8711b73912d46b43451c599aeceb3, < 4209a5125802e714a6342a74ff0835c5c4a2397d. Fixed in 4209a5125802e714a6342a74ff0835c5c4a2397d. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libgit2 is an open-source library that provides a low-level Git implementation for various programming languages. It allows developers to interact with Git repositories, perform version control operations, and access Git's functionality programmatically. This vulnerability affects the libgit2 package and specifically the git__strntol64 function.
Vulnerability Detail
The vulnerability identified in libgit2 is a heap-buffer-overflow issue. It was reported through the OSS-Fuzz project and can be found in the following bug report: OSS-Fuzz Report. The crash type associated with this vulnerability is a heap-buffer-overflow read of 1 byte. The crash state involves the functions git__strntol64, git__strntol32, and parse_mode. The severity of this vulnerability is considered medium.
How To Fix
Minimum fixed version
4209a5125802e714a6342a74ff0835c5c4a2397d
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been provided for this vulnerability.
Conclusion
In conclusion, the libgit2 package is affected by a medium severity heap-buffer-overflow vulnerability in the git__strntol64 function. It is recommended to update the package to a version that includes the fix to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libgit2 →
FAQ
libgit2 is an open-source library that provides a low-level Git implementation for various programming languages.
A heap-buffer-overflow vulnerability occurs when a program writes data beyond the bounds of a dynamically allocated buffer in the heap, potentially leading to memory corruption and crashes.
This vulnerability was discovered through the OSS-Fuzz project, which performs continuous fuzzing on open-source software to identify potential vulnerabilities.
The severity of this vulnerability is considered medium.
To fix this vulnerability, update the libgit2 package to a version that includes the fix. Refer to the provided commit for the specific fix.
References
Related vulnerabilities
Recent vulnerabilities recorded for libgit2.
