CVE-2018-10887
HIGH
8.1
CVSS Score
Published: July 10, 2018 at 02:00 PM UTC
Updated: June 17, 2026 at 01:34 AM UTC
2 products affected across 2 vendorsDebian LinuxLIBGIT2
Using libgit2 by libgit2?
Get instant alerts when new vulnerabilities affect libgit2 - before attackers find them.
Real-time alertsTrack your software stackFree plan available
Severity
HIGH8.1
Exploit prediction
EPSS 2%
Description
A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
References (6)
x_refsource_CONFIRMIssue TrackingPatch
Source: [email protected]
https://bugzilla.redhat.com/show_bug.cgi?id=1598021x_refsource_CONFIRMPatch
Source: [email protected]
https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2ax_refsource_CONFIRMPatch
Source: [email protected]
https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22x_refsource_CONFIRMPatchRelease Notes
Source: [email protected]
https://github.com/libgit2/libgit2/releases/tag/v0.27.3Mailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2018/08/msg00024.htmlMailing Listx_refsource_MLISTThird Party Advisory
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlCVSS
- Attack Vector
- NETWORK
- Complexity
- LOW
- Privileges
- NONE
- User Interaction
- REQUIRED
- Scope
- UNCHANGED
- Confidentiality
- HIGH
- Integrity
- NONE
- Availability
- HIGH
Vector?
Quick Info
StatusMODIFIED
CWE
CWE-194CWE-125CWE-190CWE-681
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.
Free plan, no card