Published: 30/05/2018 Updated: 02/05/2020

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

In Git prior to 2.13.7, 2.14.x prior to 2.14.4, 2.15.x prior to 2.15.2, 2.16.x prior to 2.16.4, and 2.17.x prior to 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.

Vulnerable Product	Search on Vulmon	Subscribe to Product
canonical ubuntu linux 18.04
canonical ubuntu linux 17.10
canonical ubuntu linux 16.04
canonical ubuntu linux 14.04
git-scm git
git-scm git 2.17.0

Synopsis Important: rh-git29-git security update Type/Severity Security Advisory: Important Topic An update for rh-git29-git is now available for Red Hat Software CollectionsRed Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) ...

Several security issues were fixed in Git ...

In Git before 2137, 214x before 2144, 215x before 2152, 216x before 2164, and 217x before 2171, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory(CVE-2018-11233) In Git before 2137, 214x before 2144, 215x before 2152, 216x before 2164, and 217x before 2171, remote code execution c ...

In Git before 2137, 214x before 2144, 215x before 2152, 216x before 2164, and 217x before 2171, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory ...

A security issue has been found in git before 2171, where the code that sanify-check paths in is_ntfs_dotgit() could have been tricked into reading random pieces of memory ...

Git security vulnerability could lead to an attack of the (repo) clones

The Register • Richard Speed • 30 May 2018

Best git patching y'all

A new version of Git has been emitted to ward off attempts to exploit a potential arbitrary code execution vulnerability – which can be triggered by merely cloning a malicious repository. The security hole, CVE-2018-11235, reported by Etienne Stalmans, stems from a flaw in Git whereby sub-module names supplied by the .gitmodules file are not properly validated when appended to $GIT_DIR/modules. Including "../" in a name could result in directory hopping. Post-checkout hooks could then be execu...

CVE-2018-11233

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Recent Articles

References

Vulmon Search

About

Products

Connect