CVE-2018-10887 - CVE House
Back to Database
Status published High CVE-2018-10887

A flaw was found in libgit2 before version 0.27.3. It...

Vulnerability Description

A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-10887

Credits & Attribution

No credits recorded in the NVD database.

References

More from libgit2

View All →
CVE-2024-24577
libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`
High 8.6
CVE-2024-24575
libgit2 is vulnerable to a denial of service attack in `git_revparse_single`
High 7.5
CVE-2023-22742
libgit2 fails to verify SSH keys by default
Medium 5.3
CVE-2020-12279
An issue was discovered in libgit2 before 0.28.4 and 0.9x...
Critical 9.8
CVE-2020-12278
An issue was discovered in libgit2 before 0.28.4 and 0.9x...
Critical 9.8

Affected Vendor

Affected Software

libgit2
Vulnerable Versions:
before version 0.27.3

Timeline

Official Publish: July 10th, 2018
Last Modified: September 17th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weaknesses (CWE)

CWE-194

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.