In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2936 advisory.

  - A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign     extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads     to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak     memory addresses or cause a Denial of Service. (CVE-2018-10887)

  - A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c     file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to     cause a Denial of Service. (CVE-2018-10888)

  - In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker     can send a crafted smart-protocol ng packet that lacks a '\0' byte to trigger an out-of-bounds read that     leads to DoS. (CVE-2018-15501)

  - Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in     libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted     repository index file. (CVE-2018-8098)

  - Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in     libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository     index file. (CVE-2018-8099)

  - A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1352)

  - An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as WSL)     while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.
    (CVE-2019-1353)

  - An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent     filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when     cloning a repository. This issue is similar to CVE-2019-1352. (CVE-2020-12278)

  - An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent     filenames that exist because of NTFS short names. This may allow remote code execution when cloning a     repository. This issue is similar to CVE-2019-1353. (CVE-2020-12279)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for libgit2 to version 0.26.5 fixes the following issues :

The following security vulnerabilities were addressed :

  - CVE-2018-10887: Fixed an integer overflow which in turn     leads to an out of bound read, allowing to read the base     object, which could be exploited by an attacker to cause     denial of service (DoS) (bsc#1100613).

  - CVE-2018-10888: Fixed an out-of-bound read while reading     a binary delta file, which could be exploited by an     attacker t ocause a denial of service (DoS)     (bsc#1100612).

  - CVE-2018-11235: Fixed a remote code execution, which     could occur with a crafted .gitmodules file     (bsc#1095219)

  - CVE-2018-15501: Prevent out-of-bounds reads when     processing smart-protocol 'ng' packets (bsc#1104641)

This update was imported from the SUSE:SLE-15:Update update project.

This update for libgit2 to version 0.26.5 fixes the following issues:
The following security vulnerabilities were addressed :

  - CVE-2018-10887: Fixed an integer overflow which in turn     leads to an out of bound read, allowing to read the base     object, which could be exploited by an attacker to cause     denial of service (DoS) (bsc#1100613).

  - CVE-2018-10888: Fixed an out-of-bound read while reading     a binary delta file, which could be exploited by an     attacker t ocause a denial of service (DoS)     (bsc#1100612).

  - CVE-2018-11235: Fixed a remote code execution, which     could occur with a crafted .gitmodules file     (bsc#1095219)

  - CVE-2018-15501: Prevent out-of-bounds reads when     processing smart-protocol 'ng' packets (bsc#1104641)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgit2 fixes the following issues :

  - CVE-2018-8099: Fixed possible denial of service attack     via different vectors by not being able to differentiate     between these status codes (bsc#1085256).

  - CVE-2018-11235: With a crafted .gitmodules file, a     malicious project can execute an arbitrary script on a     machine that runs 'git clone --recurse-submodules'     because submodule 'names' are obtained from this file,     and then appended to $GIT_DIR/modules, leading to     directory traversal with '../' in a name. Finally,     post-checkout hooks from a submodule are executed,     bypassing the intended design in which hooks are not     obtained from a remote server. (bsc#1095219)

  - CVE-2018-10887: It has been discovered that an     unexpected sign extension in git_delta_apply function in     delta.c file may have lead to an integer overflow which     in turn leads to an out of bound read, allowing to read     before the base object. An attacker could have used this     flaw to leak memory addresses or cause a Denial of     Service. (bsc#1100613)

  - CVE-2018-10888: A missing check in git_delta_apply     function in delta.c file, may lead to an out-of-bound     read while reading a binary delta file. An attacker may     use this flaw to cause a Denial of Service.
    (bsc#1100612)

  - CVE-2018-15501: A remote attacker can send a crafted     smart-protocol 'ng' packet that lacks a '\0' byte to     trigger an out-of-bounds read that leads to DoS.
    (bsc#1104641)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

CVE-2018-15501 A potential out-of-bounds read when processing a 'ng' smart packet might lead to a Denial of Service.

CVE-2018-10887 A flaw has been discovered that may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. This might be used to leak memory addresses or cause a Denial of Service.

CVE-2018-10888 A flaw may lead to an out-of-bound read while reading a binary delta file. This might result in a Denial of Service.

For Debian 8 'Jessie', these problems have been fixed in version 0.21.1-3+deb8u1.

We recommend that you upgrade your libgit2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
159090	Debian DLA-2936-1 : libgit2 - LTS security update	Nessus	Debian Local Security Checks	critical
123276	openSUSE Security Update : libgit2 (openSUSE-2019-638)	Nessus	SuSE Local Security Checks	high
120086	SUSE SLED15 / SLES15 Security Update : libgit2 (SUSE-SU-2018:2469-1)	Nessus	SuSE Local Security Checks	high
118486	openSUSE Security Update : libgit2 (openSUSE-2018-1314)	Nessus	SuSE Local Security Checks	high
112139	openSUSE Security Update : libgit2 (openSUSE-2018-922)	Nessus	SuSE Local Security Checks	high
112126	Debian DLA-1477-1 : libgit2 security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2018-15501

high

Tenable Plugins

critical

high

high

high

high

high