CVE-2018-11233

Published: May 30, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.

Affected (9)

Products: Canonical: Ubuntu Linux · Git Scm: Git

1 product

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 14.04
Canonical Ubuntu Linux	Version 16.04
Canonical Ubuntu Linux	Version 17.10
Canonical Ubuntu Linux	Version 18.04

Configuration B

5 vulnerable

Vulnerable Software	Affected Versions
Git Scm Git	Up to 2.13.6
Git Scm Git	From 2.14.0 to 2.14.3
Git Scm Git	From 2.15.0 to 2.15.1
Git Scm Git	From 2.16.0 to 2.16.3
Git Scm Git	Version 2.17.0

Related CWEs

CWE-125

Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

References (14)

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html

Source: cve@mitre.org

http://www.securityfocus.com/bid/104346

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securitytracker.com/id/1040991

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:2147

Source: cve@mitre.org

Third Party Advisory

https://marc.info/?l=git&m=152761328506724&w=2

Source: cve@mitre.org

Release NotesThird Party Advisory

https://security.gentoo.org/glsa/201805-13

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/3671-1/

Source: cve@mitre.org

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html