Lucene search

[email protected]CVE-2018-10887

HistoryJul 10, 2018 - 2:29 p.m.

CVE-2018-10887

2018-07-1014:29:00

CWE-194

CWE-681

CWE-125

CWE-190

[email protected]

web.nvd.nist.gov

cve-2018-10887

libgit2

integer overflow

out of bound read

memory leak

dos

security vulnerability

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:N/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

AI Score

7.6

Confidence

High

EPSS

0.004

Percentile

71.9%

JSON

A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.

Affected configurations

Vulners

NVD

Node

libgit2libgit2Range≤0.27.3

VendorProductVersionCPE
libgit2libgit2*cpe:2.3:a:libgit2:libgit2:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
libgit2	libgit2	*	cpe:2.3:a:libgit2:libgit2::::::::

CNA Affected

[
  {
    "product": "libgit2",
    "vendor": "libgit2",
    "versions": [
      {
        "status": "affected",
        "version": "before version 0.27.3"
      }
    ]
  }
]