Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository index file.

The remote Debian 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-2936 advisory.

  - A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign     extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads     to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak     memory addresses or cause a Denial of Service. (CVE-2018-10887)

  - A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c     file, may lead to an out-of-bound read while reading a binary delta file. An attacker may use this flaw to     cause a Denial of Service. (CVE-2018-10888)

  - In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker     can send a crafted smart-protocol ng packet that lacks a '\0' byte to trigger an out-of-bounds read that     leads to DoS. (CVE-2018-15501)

  - Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in     libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted     repository index file. (CVE-2018-8098)

  - Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in     libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository     index file. (CVE-2018-8099)

  - A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka     'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349,     CVE-2019-1350, CVE-2019-1354, CVE-2019-1387. (CVE-2019-1352)

  - An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3,     v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as WSL)     while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.
    (CVE-2019-1353)

  - An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent     filenames that exist because of NTFS Alternate Data Streams. This may allow remote code execution when     cloning a repository. This issue is similar to CVE-2019-1352. (CVE-2020-12278)

  - An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent     filenames that exist because of NTFS short names. This may allow remote code execution when cloning a     repository. This issue is similar to CVE-2019-1353. (CVE-2020-12279)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Update to 0.26.3

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for libgit2 fixes the following issues :

  - CVE-2018-8099: Fixed possible denial of service attack     via different vectors by not being able to differentiate     between these status codes (bsc#1085256).

  - CVE-2018-11235: With a crafted .gitmodules file, a     malicious project can execute an arbitrary script on a     machine that runs 'git clone --recurse-submodules'     because submodule 'names' are obtained from this file,     and then appended to $GIT_DIR/modules, leading to     directory traversal with '../' in a name. Finally,     post-checkout hooks from a submodule are executed,     bypassing the intended design in which hooks are not     obtained from a remote server. (bsc#1095219)

  - CVE-2018-10887: It has been discovered that an     unexpected sign extension in git_delta_apply function in     delta.c file may have lead to an integer overflow which     in turn leads to an out of bound read, allowing to read     before the base object. An attacker could have used this     flaw to leak memory addresses or cause a Denial of     Service. (bsc#1100613)

  - CVE-2018-10888: A missing check in git_delta_apply     function in delta.c file, may lead to an out-of-bound     read while reading a binary delta file. An attacker may     use this flaw to cause a Denial of Service.
    (bsc#1100612)

  - CVE-2018-15501: A remote attacker can send a crafted     smart-protocol 'ng' packet that lacks a '\0' byte to     trigger an out-of-bounds read that leads to DoS.
    (bsc#1104641)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

ID	Name	Product	Family	Severity
159090	Debian DLA-2936-1 : libgit2 - LTS security update	Nessus	Debian Local Security Checks	critical
120619	Fedora 28 : libgit2 (2018-924da855e1)	Nessus	Fedora Local Security Checks	medium
118486	openSUSE Security Update : libgit2 (openSUSE-2018-1314)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2018-8099

medium

Tenable Plugins

critical

medium

high