CVE-2018-15501: High severity Debian Debian Linux vulnerability
In ngpkt in transports/smartpkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to trigger an out-of-bounds read that leads to DoS.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libgit2to a version that resolves this vulnerability.Fixed in 1.1.0+dfsg.1-4+deb11u2Fixed in 1.5.1+ds-1+deb12u1Fixed in 1.9.0+ds-2Fixed in 1.9.6+ds-1 - Upgrade
Upgrade
libgit2to a version that resolves this vulnerability.Fixed in 0.26.6 - Upgrade
Upgrade
libgit2to a version that resolves this vulnerability.Fixed in 0.27.4
Event History
Frequently Asked Questions
What is CVE-2018-15501?
CVE-2018-15501 is a vulnerability in libgit2 before version 0.26.6 and 0.27.x before 0.27.4 that allows a remote attacker to trigger an out-of-bounds read leading to denial of service (DoS).
How does CVE-2018-15501 impact Debian Debian Linux 8.0?
Debian Debian Linux 8.0 is affected by CVE-2018-15501. Users running this version should update to a patched version of libgit2.
How does CVE-2018-15501 impact Debian Debian Linux 9.0?
Debian Debian Linux 9.0 is affected by CVE-2018-15501. Users running this version should update to a patched version of libgit2.
How does CVE-2018-15501 impact Libgit2 before version 0.26.6?
Libgit2 before version 0.26.6 is affected by CVE-2018-15501. Users running this version should update to a newer version.
How does CVE-2018-15501 impact Libgit2 between version 0.27.0 and 0.27.4?
Libgit2 between version 0.27.0 and 0.27.4 are affected by CVE-2018-15501. Users running these versions should update to a patched version.