CVE-2018-10887
Detail
Modified
This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.
Description
A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.
Metrics
CVSS Version 4.0
CVSS Version 3.x
CVSS Version 2.0
NVD enrichment efforts reference publicly available information to associate
vector strings. CVSS information contributed by other sources is also
displayed.
CVSS 4.0 Severity and Vector Strings:
NVD assessment
not yet provided.
CVSS 3.x Severity and Vector Strings:
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
CVSS 2.0 Severity and Vector Strings:
Vector:
(AV:N/AC:M/Au:N/C:P/I:N/A:P)
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace.
We have provided these links to other web sites because they
may have information that would be of interest to you. No
inferences should be drawn on account of other sites being
referenced, or not, from this page. There may be other web
sites that are more appropriate for your purpose. NIST does
not necessarily endorse the views expressed, or concur with
the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on
these sites. Please address comments about this page to [email protected] .
URL
Source(s)
Tag(s)
https://bugzilla.redhat.com/show_bug.cgi?id=1598021
CVE, Inc., Red Hat
Issue Tracking
Patch
https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a
CVE, Inc., Red Hat
Patch
https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22
CVE, Inc., Red Hat
Patch
https://github.com/libgit2/libgit2/releases/tag/v0.27.3
CVE, Inc., Red Hat
Patch
Release Notes
https://lists.debian.org/debian-lts-announce/2018/08/msg00024.html
CVE, Inc., Red Hat
Mailing List
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html
CVE, Inc., Red Hat
Mailing List
Third Party Advisory
Weakness Enumeration
CWE-ID
CWE Name
Source
CWE-190
Integer Overflow or Wraparound
NIST
CWE-681
Incorrect Conversion between Numeric Types
NIST
CWE-125
Out-of-bounds Read
NIST
CWE-194
Unexpected Sign Extension
Red Hat, Inc.
Change History
10 change records found show changes
CVE Modified by CVE 11/20/2024 10:42:13 PM
Action
Type
Old Value
New Value
Added
Reference
https://bugzilla.redhat.com/show_bug.cgi?id=1598021
Added
Reference
https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a
Added
Reference
https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22
Added
Reference
https://github.com/libgit2/libgit2/releases/tag/v0.27.3
Added
Reference
https://lists.debian.org/debian-lts-announce/2018/08/msg00024.html
Added
Reference
https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html
CVE Modified by Red Hat, Inc. 5/14/2024 12:54:51 AM
Action
Type
Old Value
New Value
Modified Analysis by NIST 2/15/2024 3:59:49 PM
Action
Type
Old Value
New Value
Changed
Reference Type
https://bugzilla.redhat.com/show_bug.cgi?id=1598021 Issue Tracking, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1598021 Issue Tracking, Patch
Changed
Reference Type
https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a Patch, Third Party Advisory
https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a Patch
Changed
Reference Type
https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22 Patch, Third Party Advisory
https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22 Patch
Changed
Reference Type
https://github.com/libgit2/libgit2/releases/tag/v0.27.3 Patch, Release Notes, Third Party Advisory
https://github.com/libgit2/libgit2/releases/tag/v0.27.3 Patch, Release Notes
CVE Modified by Red Hat, Inc. 11/06/2023 9:51:34 PM
Action
Type
Old Value
New Value
Removed
CWE
Red Hat, Inc. CWE-125
Removed
CWE
Red Hat, Inc. CWE-190
Modified Analysis by NIST 4/19/2022 12:07:45 PM
Action
Type
Old Value
New Value
Changed
CPE Configuration
OR
*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
OR
*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Changed
Reference Type
https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html No Types Assigned
https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html Mailing List, Third Party Advisory
CVE Modified by Red Hat, Inc. 3/20/2022 11:15:07 PM
Action
Type
Old Value
New Value
Added
Reference
https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html [No Types Assigned]
Modified Analysis by NIST 8/31/2020 11:56:33 AM
Action
Type
Old Value
New Value
Added
CVSS V3.1
NIST AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Removed
CVSS V3
NIST AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Added
CWE
NIST CWE-681
Changed
Reference Type
https://bugzilla.redhat.com/show_bug.cgi?id=1598021 Issue Tracking, Patch
https://bugzilla.redhat.com/show_bug.cgi?id=1598021 Issue Tracking, Patch, Third Party Advisory
CVE Modified by Red Hat, Inc. 10/09/2019 7:33:09 PM
Action
Type
Old Value
New Value
Added
CWE
Red Hat, Inc. CWE-125
Added
CWE
Red Hat, Inc. CWE-190
Added
CWE
Red Hat, Inc. CWE-194
Initial Analysis by NIST 9/06/2018 11:27:31 AM
Action
Type
Old Value
New Value
Added
CVSS V3
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Added
CVSS V2
(AV:N/AC:M/Au:N/C:P/I:N/A:P)
Added
CWE
CWE-125
Added
CWE
CWE-190
Added
CPE Configuration
OR
*cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:* versions up to (excluding) 0.27.3
Added
CPE Configuration
OR
*cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Changed
Reference Type
https://bugzilla.redhat.com/show_bug.cgi?id=1598021 No Types Assigned
https://bugzilla.redhat.com/show_bug.cgi?id=1598021 Issue Tracking, Patch
Changed
Reference Type
https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a No Types Assigned
https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a Patch, Third Party Advisory
Changed
Reference Type
https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22 No Types Assigned
https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22 Patch, Third Party Advisory
Changed
Reference Type
https://github.com/libgit2/libgit2/releases/tag/v0.27.3 No Types Assigned
https://github.com/libgit2/libgit2/releases/tag/v0.27.3 Patch, Release Notes, Third Party Advisory
Changed
Reference Type
https://lists.debian.org/debian-lts-announce/2018/08/msg00024.html No Types Assigned
https://lists.debian.org/debian-lts-announce/2018/08/msg00024.html Mailing List, Third Party Advisory
Added
CVSS V2 Metadata
Victim must voluntarily interact with attack mechanism
CVE Modified by Red Hat, Inc. 8/26/2018 6:29:00 AM
Action
Type
Old Value
New Value
Added
Reference
https://lists.debian.org/debian-lts-announce/2018/08/msg00024.html [No Types Assigned]
Quick Info
CVE Dictionary Entry: CVE-2018-10887 NVD
Published Date: 07/10/2018 NVD
Last Modified: 11/20/2024
Source: Red Hat, Inc.