csaf_opensuse - opensuse-su-2024:10943-1

Vulnerability from csaf_opensuse

Published

2024-06-15 00:00

Modified

2024-06-15 00:00

Summary

libgit2-1_1-1.1.1-1.2 on GA media

Notes

Title of the patch

libgit2-1_1-1.1.1-1.2 on GA media

Description of the patch

These are all security issues fixed in the libgit2-1_1-1.1.1-1.2 package on the GA media of openSUSE Tumbleweed.

Patchnames

openSUSE-Tumbleweed-2024-10943

CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).

JSON

To clipboard

{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "libgit2-1_1-1.1.1-1.2 on GA media",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "These are all security issues fixed in the libgit2-1_1-1.1.1-1.2 package on the GA media of openSUSE Tumbleweed.",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "openSUSE-Tumbleweed-2024-10943",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10943-1.json",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2005-4900 page",
            url: "https://www.suse.com/security/cve/CVE-2005-4900/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-10128 page",
            url: "https://www.suse.com/security/cve/CVE-2016-10128/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2016-10130 page",
            url: "https://www.suse.com/security/cve/CVE-2016-10130/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-10887 page",
            url: "https://www.suse.com/security/cve/CVE-2018-10887/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-11235 page",
            url: "https://www.suse.com/security/cve/CVE-2018-11235/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-17456 page",
            url: "https://www.suse.com/security/cve/CVE-2018-17456/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2018-8098 page",
            url: "https://www.suse.com/security/cve/CVE-2018-8098/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-1348 page",
            url: "https://www.suse.com/security/cve/CVE-2019-1348/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-1349 page",
            url: "https://www.suse.com/security/cve/CVE-2019-1349/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-1350 page",
            url: "https://www.suse.com/security/cve/CVE-2019-1350/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-1351 page",
            url: "https://www.suse.com/security/cve/CVE-2019-1351/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-1352 page",
            url: "https://www.suse.com/security/cve/CVE-2019-1352/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-1353 page",
            url: "https://www.suse.com/security/cve/CVE-2019-1353/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-1354 page",
            url: "https://www.suse.com/security/cve/CVE-2019-1354/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2019-1387 page",
            url: "https://www.suse.com/security/cve/CVE-2019-1387/",
         },
      ],
      title: "libgit2-1_1-1.1.1-1.2 on GA media",
      tracking: {
         current_release_date: "2024-06-15T00:00:00Z",
         generator: {
            date: "2024-06-15T00:00:00Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "openSUSE-SU-2024:10943-1",
         initial_release_date: "2024-06-15T00:00:00Z",
         revision_history: [
            {
               date: "2024-06-15T00:00:00Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libgit2-1_1-1.1.1-1.2.aarch64",
                        product: {
                           name: "libgit2-1_1-1.1.1-1.2.aarch64",
                           product_id: "libgit2-1_1-1.1.1-1.2.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                        product: {
                           name: "libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                           product_id: "libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libgit2-devel-1.1.1-1.2.aarch64",
                        product: {
                           name: "libgit2-devel-1.1.1-1.2.aarch64",
                           product_id: "libgit2-devel-1.1.1-1.2.aarch64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "aarch64",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libgit2-1_1-1.1.1-1.2.ppc64le",
                        product: {
                           name: "libgit2-1_1-1.1.1-1.2.ppc64le",
                           product_id: "libgit2-1_1-1.1.1-1.2.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                        product: {
                           name: "libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                           product_id: "libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libgit2-devel-1.1.1-1.2.ppc64le",
                        product: {
                           name: "libgit2-devel-1.1.1-1.2.ppc64le",
                           product_id: "libgit2-devel-1.1.1-1.2.ppc64le",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "ppc64le",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libgit2-1_1-1.1.1-1.2.s390x",
                        product: {
                           name: "libgit2-1_1-1.1.1-1.2.s390x",
                           product_id: "libgit2-1_1-1.1.1-1.2.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libgit2-1_1-32bit-1.1.1-1.2.s390x",
                        product: {
                           name: "libgit2-1_1-32bit-1.1.1-1.2.s390x",
                           product_id: "libgit2-1_1-32bit-1.1.1-1.2.s390x",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libgit2-devel-1.1.1-1.2.s390x",
                        product: {
                           name: "libgit2-devel-1.1.1-1.2.s390x",
                           product_id: "libgit2-devel-1.1.1-1.2.s390x",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "s390x",
               },
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "libgit2-1_1-1.1.1-1.2.x86_64",
                        product: {
                           name: "libgit2-1_1-1.1.1-1.2.x86_64",
                           product_id: "libgit2-1_1-1.1.1-1.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                        product: {
                           name: "libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                           product_id: "libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                        },
                     },
                     {
                        category: "product_version",
                        name: "libgit2-devel-1.1.1-1.2.x86_64",
                        product: {
                           name: "libgit2-devel-1.1.1-1.2.x86_64",
                           product_id: "libgit2-devel-1.1.1-1.2.x86_64",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "x86_64",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "openSUSE Tumbleweed",
                        product: {
                           name: "openSUSE Tumbleweed",
                           product_id: "openSUSE Tumbleweed",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:tumbleweed",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-1_1-1.1.1-1.2.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
            },
            product_reference: "libgit2-1_1-1.1.1-1.2.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-1_1-1.1.1-1.2.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
            },
            product_reference: "libgit2-1_1-1.1.1-1.2.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-1_1-1.1.1-1.2.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
            },
            product_reference: "libgit2-1_1-1.1.1-1.2.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-1_1-1.1.1-1.2.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
            },
            product_reference: "libgit2-1_1-1.1.1-1.2.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-1_1-32bit-1.1.1-1.2.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
            },
            product_reference: "libgit2-1_1-32bit-1.1.1-1.2.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-1_1-32bit-1.1.1-1.2.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
            },
            product_reference: "libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-1_1-32bit-1.1.1-1.2.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
            },
            product_reference: "libgit2-1_1-32bit-1.1.1-1.2.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-1_1-32bit-1.1.1-1.2.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
            },
            product_reference: "libgit2-1_1-32bit-1.1.1-1.2.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-devel-1.1.1-1.2.aarch64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
            },
            product_reference: "libgit2-devel-1.1.1-1.2.aarch64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-devel-1.1.1-1.2.ppc64le as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
            },
            product_reference: "libgit2-devel-1.1.1-1.2.ppc64le",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-devel-1.1.1-1.2.s390x as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
            },
            product_reference: "libgit2-devel-1.1.1-1.2.s390x",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "libgit2-devel-1.1.1-1.2.x86_64 as component of openSUSE Tumbleweed",
               product_id: "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            },
            product_reference: "libgit2-devel-1.1.1-1.2.x86_64",
            relates_to_product_reference: "openSUSE Tumbleweed",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2005-4900",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2005-4900",
            },
         ],
         notes: [
            {
               category: "general",
               text: "SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2.  NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2005-4900",
               url: "https://www.suse.com/security/cve/CVE-2005-4900",
            },
            {
               category: "external",
               summary: "SUSE Bug 1026646 for CVE-2005-4900",
               url: "https://bugzilla.suse.com/1026646",
            },
            {
               category: "external",
               summary: "SUSE Bug 1026936 for CVE-2005-4900",
               url: "https://bugzilla.suse.com/1026936",
            },
            {
               category: "external",
               summary: "SUSE Bug 1042640 for CVE-2005-4900",
               url: "https://bugzilla.suse.com/1042640",
            },
            {
               category: "external",
               summary: "SUSE Bug 1150998 for CVE-2005-4900",
               url: "https://bugzilla.suse.com/1150998",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2005-4900",
      },
      {
         cve: "CVE-2016-10128",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-10128",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-10128",
               url: "https://www.suse.com/security/cve/CVE-2016-10128",
            },
            {
               category: "external",
               summary: "SUSE Bug 1019036 for CVE-2016-10128",
               url: "https://bugzilla.suse.com/1019036",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2016-10128",
      },
      {
         cve: "CVE-2016-10130",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2016-10130",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2016-10130",
               url: "https://www.suse.com/security/cve/CVE-2016-10130",
            },
            {
               category: "external",
               summary: "SUSE Bug 1019037 for CVE-2016-10130",
               url: "https://bugzilla.suse.com/1019037",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2016-10130",
      },
      {
         cve: "CVE-2018-10887",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-10887",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-10887",
               url: "https://www.suse.com/security/cve/CVE-2018-10887",
            },
            {
               category: "external",
               summary: "SUSE Bug 1100613 for CVE-2018-10887",
               url: "https://bugzilla.suse.com/1100613",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 6.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-10887",
      },
      {
         cve: "CVE-2018-11235",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-11235",
            },
         ],
         notes: [
            {
               category: "general",
               text: "In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs \"git clone --recurse-submodules\" because submodule \"names\" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with \"../\" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-11235",
               url: "https://www.suse.com/security/cve/CVE-2018-11235",
            },
            {
               category: "external",
               summary: "SUSE Bug 1095219 for CVE-2018-11235",
               url: "https://bugzilla.suse.com/1095219",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2018-11235",
      },
      {
         cve: "CVE-2018-17456",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-17456",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-17456",
               url: "https://www.suse.com/security/cve/CVE-2018-17456",
            },
            {
               category: "external",
               summary: "SUSE Bug 1110949 for CVE-2018-17456",
               url: "https://bugzilla.suse.com/1110949",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2018-17456",
      },
      {
         cve: "CVE-2018-8098",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2018-8098",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted repository index file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2018-8098",
               url: "https://www.suse.com/security/cve/CVE-2018-8098",
            },
            {
               category: "external",
               summary: "SUSE Bug 1085256 for CVE-2018-8098",
               url: "https://bugzilla.suse.com/1085256",
            },
            {
               category: "external",
               summary: "SUSE Bug 1085257 for CVE-2018-8098",
               url: "https://bugzilla.suse.com/1085257",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.5,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
                  version: "3.0",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "moderate",
            },
         ],
         title: "CVE-2018-8098",
      },
      {
         cve: "CVE-2019-1348",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-1348",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-1348",
               url: "https://www.suse.com/security/cve/CVE-2019-1348",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158785 for CVE-2019-1348",
               url: "https://bugzilla.suse.com/1158785",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 3.3,
                  baseSeverity: "LOW",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "low",
            },
         ],
         title: "CVE-2019-1348",
      },
      {
         cve: "CVE-2019-1349",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-1349",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-1349",
               url: "https://www.suse.com/security/cve/CVE-2019-1349",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158785 for CVE-2019-1349",
               url: "https://bugzilla.suse.com/1158785",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158787 for CVE-2019-1349",
               url: "https://bugzilla.suse.com/1158787",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "critical",
            },
         ],
         title: "CVE-2019-1349",
      },
      {
         cve: "CVE-2019-1350",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-1350",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-1350",
               url: "https://www.suse.com/security/cve/CVE-2019-1350",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158785 for CVE-2019-1350",
               url: "https://bugzilla.suse.com/1158785",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158788 for CVE-2019-1350",
               url: "https://bugzilla.suse.com/1158788",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "critical",
            },
         ],
         title: "CVE-2019-1350",
      },
      {
         cve: "CVE-2019-1351",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-1351",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-1351",
               url: "https://www.suse.com/security/cve/CVE-2019-1351",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158785 for CVE-2019-1351",
               url: "https://bugzilla.suse.com/1158785",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158789 for CVE-2019-1351",
               url: "https://bugzilla.suse.com/1158789",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2019-1351",
      },
      {
         cve: "CVE-2019-1352",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-1352",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-1352",
               url: "https://www.suse.com/security/cve/CVE-2019-1352",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158785 for CVE-2019-1352",
               url: "https://bugzilla.suse.com/1158785",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158787 for CVE-2019-1352",
               url: "https://bugzilla.suse.com/1158787",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158790 for CVE-2019-1352",
               url: "https://bugzilla.suse.com/1158790",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "critical",
            },
         ],
         title: "CVE-2019-1352",
      },
      {
         cve: "CVE-2019-1353",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-1353",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as \"WSL\") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-1353",
               url: "https://www.suse.com/security/cve/CVE-2019-1353",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158785 for CVE-2019-1353",
               url: "https://bugzilla.suse.com/1158785",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158791 for CVE-2019-1353",
               url: "https://bugzilla.suse.com/1158791",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 9.8,
                  baseSeverity: "CRITICAL",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "critical",
            },
         ],
         title: "CVE-2019-1353",
      },
      {
         cve: "CVE-2019-1354",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-1354",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-1354",
               url: "https://www.suse.com/security/cve/CVE-2019-1354",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158785 for CVE-2019-1354",
               url: "https://bugzilla.suse.com/1158785",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158792 for CVE-2019-1354",
               url: "https://bugzilla.suse.com/1158792",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 0,
                  baseSeverity: "NONE",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "low",
            },
         ],
         title: "CVE-2019-1354",
      },
      {
         cve: "CVE-2019-1387",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2019-1387",
            },
         ],
         notes: [
            {
               category: "general",
               text: "An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
               "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2019-1387",
               url: "https://www.suse.com/security/cve/CVE-2019-1387",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158785 for CVE-2019-1387",
               url: "https://bugzilla.suse.com/1158785",
            },
            {
               category: "external",
               summary: "SUSE Bug 1158793 for CVE-2019-1387",
               url: "https://bugzilla.suse.com/1158793",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 8.8,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-1_1-32bit-1.1.1-1.2.x86_64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.aarch64",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.ppc64le",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.s390x",
                  "openSUSE Tumbleweed:libgit2-devel-1.1.1-1.2.x86_64",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2024-06-15T00:00:00Z",
               details: "important",
            },
         ],
         title: "CVE-2019-1387",
      },
   ],
}

CVE-2019-1353 (GCVE-0-2019-1353)

Vulnerability from cvelistv5

Published

2020-01-24 21:14

Modified

2024-08-04 18:13

Severity ?

Summary

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as "WSL") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.

References

▼	URL	Tags
	https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u	x_refsource_MISC
	https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202003-30	vendor-advisory, x_refsource_GENTOO
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	Microsoft Corporation	Git	Version: Before 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, 2.14.6

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T18:13:30.473Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
               },
               {
                  name: "openSUSE-SU-2020:0123",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
               },
               {
                  name: "GLSA-202003-30",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-30",
               },
               {
                  name: "openSUSE-SU-2020:0598",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Git",
               vendor: "Microsoft Corporation",
               versions: [
                  {
                     status: "affected",
                     version: "Before 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, 2.14.6",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as \"WSL\") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Remote Code Execution",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-05-01T23:06:10",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
            },
            {
               name: "openSUSE-SU-2020:0123",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
            },
            {
               name: "GLSA-202003-30",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-30",
            },
            {
               name: "openSUSE-SU-2020:0598",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secure@microsoft.com",
               ID: "CVE-2019-1353",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Git",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Before 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, 2.14.6",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Microsoft Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. When running Git in the Windows Subsystem for Linux (also known as \"WSL\") while accessing a working directory on a regular Windows drive, none of the NTFS protections were active.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Remote Code Execution",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/T/#u",
                     refsource: "MISC",
                     url: "https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/T/#u",
                  },
                  {
                     name: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                     refsource: "MISC",
                     url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                  },
                  {
                     name: "openSUSE-SU-2020:0123",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
                  },
                  {
                     name: "GLSA-202003-30",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-30",
                  },
                  {
                     name: "openSUSE-SU-2020:0598",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2019-1353",
      datePublished: "2020-01-24T21:14:21",
      dateReserved: "2018-11-26T00:00:00",
      dateUpdated: "2024-08-04T18:13:30.473Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2019-1387 (GCVE-0-2019-1387)

Vulnerability from cvelistv5

Published

2019-12-18 20:11

Modified

2024-08-04 18:13

Severity ?

Summary

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.

References

▼	URL	Tags
	https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u
	https://access.redhat.com/errata/RHSA-2019:4356	vendor-advisory
	https://access.redhat.com/errata/RHSA-2020:0002	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/	vendor-advisory
	https://access.redhat.com/errata/RHSA-2020:0124	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html	mailing-list
	https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	vendor-advisory
	https://access.redhat.com/errata/RHSA-2020:0228	vendor-advisory
	https://security.gentoo.org/glsa/202003-30	vendor-advisory
	https://security.gentoo.org/glsa/202003-42	vendor-advisory
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	vendor-advisory
	https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html	mailing-list

Impacted products

	Vendor	Product	Version
	Microsoft Corporation	Git	Version: Before v2.24.1 Version: Before v2.23.1 Version: Before v2.22.2 Version: Before v2.21.1 Version: Before v2.20.2 Version: Before v2.19.3 Version: Before v2.18.2 Version: Before v2.17.3 Version: Before v2.16.6 Version: Before v2.15.4 Version: Before v2.14.6

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            affected: [
               {
                  cpes: [
                     "cpe:2.3:a:git:git:*:*:*:*:*:*:*:*",
                  ],
                  defaultStatus: "unknown",
                  product: "git",
                  vendor: "git",
                  versions: [
                     {
                        lessThan: "2,24.1",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "2.23.1",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "2.22.2",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "2.21.1",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "2.20.2",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "2.19.3",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "2.18.2",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "2.17.3",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "2.16.6",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "2.15.4",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                     {
                        lessThan: "2.14.6",
                        status: "affected",
                        version: "0",
                        versionType: "custom",
                     },
                  ],
               },
            ],
            metrics: [
               {
                  other: {
                     content: {
                        id: "CVE-2019-1387",
                        options: [
                           {
                              Exploitation: "none",
                           },
                           {
                              Automatable: "no",
                           },
                           {
                              "Technical Impact": "total",
                           },
                        ],
                        role: "CISA Coordinator",
                        timestamp: "2024-07-19T18:49:36.663475Z",
                        version: "2.0.3",
                     },
                     type: "ssvc",
                  },
               },
            ],
            providerMetadata: {
               dateUpdated: "2024-07-19T19:03:52.040Z",
               orgId: "134c704f-9b21-4f2e-91b3-4a467353bcc0",
               shortName: "CISA-ADP",
            },
            title: "CISA ADP Vulnrichment",
         },
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T18:13:30.492Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u",
               },
               {
                  name: "RHSA-2019:4356",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2019:4356",
               },
               {
                  name: "RHSA-2020:0002",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2020:0002",
               },
               {
                  name: "FEDORA-2019-1cec196e20",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/",
               },
               {
                  name: "RHSA-2020:0124",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2020:0124",
               },
               {
                  name: "[debian-lts-announce] 20200123 [SECURITY] [DLA 2059-1] git security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html",
               },
               {
                  tags: [
                     "x_transferred",
                  ],
                  url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
               },
               {
                  name: "openSUSE-SU-2020:0123",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
               },
               {
                  name: "RHSA-2020:0228",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2020:0228",
               },
               {
                  name: "GLSA-202003-30",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-30",
               },
               {
                  name: "GLSA-202003-42",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-42",
               },
               {
                  name: "openSUSE-SU-2020:0598",
                  tags: [
                     "vendor-advisory",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
               },
               {
                  name: "[debian-lts-announce] 20240626 [SECURITY] [DLA 3844-1] git security update",
                  tags: [
                     "mailing-list",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Git",
               vendor: "Microsoft Corporation",
               versions: [
                  {
                     status: "affected",
                     version: "Before v2.24.1",
                  },
                  {
                     status: "affected",
                     version: "Before v2.23.1",
                  },
                  {
                     status: "affected",
                     version: "Before v2.22.2",
                  },
                  {
                     status: "affected",
                     version: "Before v2.21.1",
                  },
                  {
                     status: "affected",
                     version: "Before v2.20.2",
                  },
                  {
                     status: "affected",
                     version: "Before v2.19.3",
                  },
                  {
                     status: "affected",
                     version: "Before v2.18.2",
                  },
                  {
                     status: "affected",
                     version: "Before v2.17.3",
                  },
                  {
                     status: "affected",
                     version: "Before v2.16.6",
                  },
                  {
                     status: "affected",
                     version: "Before v2.15.4",
                  },
                  {
                     status: "affected",
                     version: "Before v2.14.6",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recursive clones are currently affected by a vulnerability that is caused by too-lax validation of submodule names, allowing very targeted attacks via remote code execution in recursive clones.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Remote Code Execution",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2024-06-26T10:06:04.659245",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               url: "https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u",
            },
            {
               name: "RHSA-2019:4356",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2019:4356",
            },
            {
               name: "RHSA-2020:0002",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2020:0002",
            },
            {
               name: "FEDORA-2019-1cec196e20",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6UGTEOXWIYSM5KDZL74QD2GK6YQNQCP/",
            },
            {
               name: "RHSA-2020:0124",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2020:0124",
            },
            {
               name: "[debian-lts-announce] 20200123 [SECURITY] [DLA 2059-1] git security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2020/01/msg00019.html",
            },
            {
               url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
            },
            {
               name: "openSUSE-SU-2020:0123",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
            },
            {
               name: "RHSA-2020:0228",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://access.redhat.com/errata/RHSA-2020:0228",
            },
            {
               name: "GLSA-202003-30",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202003-30",
            },
            {
               name: "GLSA-202003-42",
               tags: [
                  "vendor-advisory",
               ],
               url: "https://security.gentoo.org/glsa/202003-42",
            },
            {
               name: "openSUSE-SU-2020:0598",
               tags: [
                  "vendor-advisory",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
            },
            {
               name: "[debian-lts-announce] 20240626 [SECURITY] [DLA 3844-1] git security update",
               tags: [
                  "mailing-list",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2024/06/msg00018.html",
            },
         ],
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2019-1387",
      datePublished: "2019-12-18T20:11:53",
      dateReserved: "2018-11-26T00:00:00",
      dateUpdated: "2024-08-04T18:13:30.492Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2018-10887 (GCVE-0-2018-10887)

Vulnerability from cvelistv5

Published

2018-07-10 14:00

Modified

2024-09-17 01:06

Severity ?

Summary

A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.

References

▼	URL	Tags
	https://bugzilla.redhat.com/show_bug.cgi?id=1598021	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2018/08/msg00024.html	mailing-list, x_refsource_MLIST
	https://github.com/libgit2/libgit2/releases/tag/v0.27.3	x_refsource_CONFIRM
	https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22	x_refsource_CONFIRM
	https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	libgit2	libgit2	Version: before version 0.27.3

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T07:54:34.874Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://bugzilla.redhat.com/show_bug.cgi?id=1598021",
               },
               {
                  name: "[debian-lts-announce] 20180825 [SECURITY] [DLA 1477-1] libgit2 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2018/08/msg00024.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/libgit2/libgit2/releases/tag/v0.27.3",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a",
               },
               {
                  name: "[debian-lts-announce] 20220321 [SECURITY] [DLA 2936-1] libgit2 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "libgit2",
               vendor: "libgit2",
               versions: [
                  {
                     status: "affected",
                     version: "before version 0.27.3",
                  },
               ],
            },
         ],
         datePublic: "2018-07-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     cweId: "CWE-194",
                     description: "CWE-194->CWE-190->CWE-125",
                     lang: "en",
                     type: "CWE",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-21T02:06:10",
            orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
            shortName: "redhat",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://bugzilla.redhat.com/show_bug.cgi?id=1598021",
            },
            {
               name: "[debian-lts-announce] 20180825 [SECURITY] [DLA 1477-1] libgit2 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2018/08/msg00024.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/libgit2/libgit2/releases/tag/v0.27.3",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a",
            },
            {
               name: "[debian-lts-announce] 20220321 [SECURITY] [DLA 2936-1] libgit2 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secalert@redhat.com",
               DATE_PUBLIC: "2018-07-09T00:00:00",
               ID: "CVE-2018-10887",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "libgit2",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "before version 0.27.3",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "libgit2",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "CWE-194->CWE-190->CWE-125",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://bugzilla.redhat.com/show_bug.cgi?id=1598021",
                     refsource: "CONFIRM",
                     url: "https://bugzilla.redhat.com/show_bug.cgi?id=1598021",
                  },
                  {
                     name: "[debian-lts-announce] 20180825 [SECURITY] [DLA 1477-1] libgit2 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2018/08/msg00024.html",
                  },
                  {
                     name: "https://github.com/libgit2/libgit2/releases/tag/v0.27.3",
                     refsource: "CONFIRM",
                     url: "https://github.com/libgit2/libgit2/releases/tag/v0.27.3",
                  },
                  {
                     name: "https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22",
                     refsource: "CONFIRM",
                     url: "https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22",
                  },
                  {
                     name: "https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a",
                     refsource: "CONFIRM",
                     url: "https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2a",
                  },
                  {
                     name: "[debian-lts-announce] 20220321 [SECURITY] [DLA 2936-1] libgit2 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749",
      assignerShortName: "redhat",
      cveId: "CVE-2018-10887",
      datePublished: "2018-07-10T14:00:00Z",
      dateReserved: "2018-05-09T00:00:00",
      dateUpdated: "2024-09-17T01:06:07.091Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2005-4900 (GCVE-0-2005-4900)

Vulnerability from cvelistv5

Published

2016-10-14 16:00

Modified

2024-08-08 00:01

Severity ?

Summary

SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2. NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation.

References

▼	URL	Tags
	https://sites.google.com/site/itstheshappening	x_refsource_MISC
	http://www.securityfocus.com/bid/12577	vdb-entry, x_refsource_BID
	http://shattered.io/	x_refsource_MISC
	https://www.schneier.com/blog/archives/2005/08/new_cryptanalyt.html	x_refsource_MISC
	http://www.cwi.nl/news/2017/cwi-and-google-announce-first-collision-industry-security-standard-sha-1	x_refsource_MISC
	http://ia.cr/2007/474	x_refsource_MISC
	https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html	x_refsource_MISC
	https://security.googleblog.com/2015/12/an-update-on-sha-1-certificates-in.html	x_refsource_MISC
	https://www.schneier.com/blog/archives/2005/02/sha1_broken.html	x_refsource_MISC
	https://arstechnica.com/security/2017/02/at-deaths-door-for-years-widely-used-sha1-function-is-now-dead/	x_refsource_MISC
	https://kc.mcafee.com/corporate/index?page=content&id=SB10340	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-08T00:01:23.514Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://sites.google.com/site/itstheshappening",
               },
               {
                  name: "12577",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/12577",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://shattered.io/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.schneier.com/blog/archives/2005/08/new_cryptanalyt.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://www.cwi.nl/news/2017/cwi-and-google-announce-first-collision-industry-security-standard-sha-1",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://ia.cr/2007/474",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://security.googleblog.com/2015/12/an-update-on-sha-1-certificates-in.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.schneier.com/blog/archives/2005/02/sha1_broken.html",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://arstechnica.com/security/2017/02/at-deaths-door-for-years-widely-used-sha1-function-is-now-dead/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10340",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2005-02-15T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2.  NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-12-09T08:06:17",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://sites.google.com/site/itstheshappening",
            },
            {
               name: "12577",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/12577",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://shattered.io/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.schneier.com/blog/archives/2005/08/new_cryptanalyt.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://www.cwi.nl/news/2017/cwi-and-google-announce-first-collision-industry-security-standard-sha-1",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://ia.cr/2007/474",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://security.googleblog.com/2015/12/an-update-on-sha-1-certificates-in.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.schneier.com/blog/archives/2005/02/sha1_broken.html",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://arstechnica.com/security/2017/02/at-deaths-door-for-years-widely-used-sha1-function-is-now-dead/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10340",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2005-4900",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "SHA-1 is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of SHA-1 in TLS 1.2.  NOTE: this CVE exists to provide a common identifier for referencing this SHA-1 issue; the existence of an identifier is not, by itself, a technology recommendation.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://sites.google.com/site/itstheshappening",
                     refsource: "MISC",
                     url: "https://sites.google.com/site/itstheshappening",
                  },
                  {
                     name: "12577",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/12577",
                  },
                  {
                     name: "http://shattered.io/",
                     refsource: "MISC",
                     url: "http://shattered.io/",
                  },
                  {
                     name: "https://www.schneier.com/blog/archives/2005/08/new_cryptanalyt.html",
                     refsource: "MISC",
                     url: "https://www.schneier.com/blog/archives/2005/08/new_cryptanalyt.html",
                  },
                  {
                     name: "http://www.cwi.nl/news/2017/cwi-and-google-announce-first-collision-industry-security-standard-sha-1",
                     refsource: "MISC",
                     url: "http://www.cwi.nl/news/2017/cwi-and-google-announce-first-collision-industry-security-standard-sha-1",
                  },
                  {
                     name: "http://ia.cr/2007/474",
                     refsource: "MISC",
                     url: "http://ia.cr/2007/474",
                  },
                  {
                     name: "https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html",
                     refsource: "MISC",
                     url: "https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html",
                  },
                  {
                     name: "https://security.googleblog.com/2015/12/an-update-on-sha-1-certificates-in.html",
                     refsource: "MISC",
                     url: "https://security.googleblog.com/2015/12/an-update-on-sha-1-certificates-in.html",
                  },
                  {
                     name: "https://www.schneier.com/blog/archives/2005/02/sha1_broken.html",
                     refsource: "MISC",
                     url: "https://www.schneier.com/blog/archives/2005/02/sha1_broken.html",
                  },
                  {
                     name: "https://arstechnica.com/security/2017/02/at-deaths-door-for-years-widely-used-sha1-function-is-now-dead/",
                     refsource: "MISC",
                     url: "https://arstechnica.com/security/2017/02/at-deaths-door-for-years-widely-used-sha1-function-is-now-dead/",
                  },
                  {
                     name: "https://kc.mcafee.com/corporate/index?page=content&id=SB10340",
                     refsource: "CONFIRM",
                     url: "https://kc.mcafee.com/corporate/index?page=content&id=SB10340",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2005-4900",
      datePublished: "2016-10-14T16:00:00",
      dateReserved: "2016-10-14T00:00:00",
      dateUpdated: "2024-08-08T00:01:23.514Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2019-1351 (GCVE-0-2019-1351)

Vulnerability from cvelistv5

Published

2020-01-24 20:50

Modified

2024-08-04 18:13

Severity ?

Summary

A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351	x_refsource_MISC
	https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202003-30	vendor-advisory, x_refsource_GENTOO
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	vendor-advisory, x_refsource_SUSE

Impacted products

Vendor

Product

Version

▼

Microsoft

Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)

Version: unspecified

Microsoft	Microsoft Visual Studio 2017	Version: 15.0
Microsoft	Microsoft Visual Studio 2019	Version: 16.0
Microsoft	Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)	Version: unspecified

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T18:13:30.499Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
               },
               {
                  name: "openSUSE-SU-2020:0123",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
               },
               {
                  name: "GLSA-202003-30",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-30",
               },
               {
                  name: "openSUSE-SU-2020:0598",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "unspecified",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2017",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "15.0",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2019",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "16.0",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "unspecified",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Tampering",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-05-01T23:06:04",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
            },
            {
               name: "openSUSE-SU-2020:0123",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
            },
            {
               name: "GLSA-202003-30",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-30",
            },
            {
               name: "openSUSE-SU-2020:0598",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secure@microsoft.com",
               ID: "CVE-2019-1351",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2017",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "15.0",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2019",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "16.0",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Microsoft",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A tampering vulnerability exists when Git for Visual Studio improperly handles virtual drive paths, aka 'Git for Visual Studio Tampering Vulnerability'.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Tampering",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351",
                     refsource: "MISC",
                     url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1351",
                  },
                  {
                     name: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                     refsource: "MISC",
                     url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                  },
                  {
                     name: "openSUSE-SU-2020:0123",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
                  },
                  {
                     name: "GLSA-202003-30",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-30",
                  },
                  {
                     name: "openSUSE-SU-2020:0598",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2019-1351",
      datePublished: "2020-01-24T20:50:26",
      dateReserved: "2018-11-26T00:00:00",
      dateUpdated: "2024-08-04T18:13:30.499Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2018-8098 (GCVE-0-2018-8098)

Vulnerability from cvelistv5

Published

2018-03-14 00:00

Modified

2024-08-05 06:46

Severity ?

Summary

Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted repository index file.

References

▼	URL	Tags
	https://github.com/libgit2/libgit2/commit/3207ddb0103543da8ad2139ec6539f590f9900c1	x_refsource_CONFIRM
	https://libgit2.github.com/security/	x_refsource_CONFIRM
	https://github.com/libgit2/libgit2/commit/3db1af1f370295ad5355b8f64b865a2a357bcac0	x_refsource_CONFIRM
	https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html	mailing-list, x_refsource_MLIST

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T06:46:13.414Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/libgit2/libgit2/commit/3207ddb0103543da8ad2139ec6539f590f9900c1",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://libgit2.github.com/security/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/libgit2/libgit2/commit/3db1af1f370295ad5355b8f64b865a2a357bcac0",
               },
               {
                  name: "[debian-lts-announce] 20220321 [SECURITY] [DLA 2936-1] libgit2 security update",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-03-13T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted repository index file.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2022-03-21T02:06:13",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/libgit2/libgit2/commit/3207ddb0103543da8ad2139ec6539f590f9900c1",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://libgit2.github.com/security/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/libgit2/libgit2/commit/3db1af1f370295ad5355b8f64b865a2a357bcac0",
            },
            {
               name: "[debian-lts-announce] 20220321 [SECURITY] [DLA 2936-1] libgit2 security update",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2018-8098",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Integer overflow in the index.c:read_entry() function while decompressing a compressed prefix length in libgit2 before v0.26.2 allows an attacker to cause a denial of service (out-of-bounds read) via a crafted repository index file.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://github.com/libgit2/libgit2/commit/3207ddb0103543da8ad2139ec6539f590f9900c1",
                     refsource: "CONFIRM",
                     url: "https://github.com/libgit2/libgit2/commit/3207ddb0103543da8ad2139ec6539f590f9900c1",
                  },
                  {
                     name: "https://libgit2.github.com/security/",
                     refsource: "CONFIRM",
                     url: "https://libgit2.github.com/security/",
                  },
                  {
                     name: "https://github.com/libgit2/libgit2/commit/3db1af1f370295ad5355b8f64b865a2a357bcac0",
                     refsource: "CONFIRM",
                     url: "https://github.com/libgit2/libgit2/commit/3db1af1f370295ad5355b8f64b865a2a357bcac0",
                  },
                  {
                     name: "[debian-lts-announce] 20220321 [SECURITY] [DLA 2936-1] libgit2 security update",
                     refsource: "MLIST",
                     url: "https://lists.debian.org/debian-lts-announce/2022/03/msg00031.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2018-8098",
      datePublished: "2018-03-14T00:00:00",
      dateReserved: "2018-03-13T00:00:00",
      dateUpdated: "2024-08-05T06:46:13.414Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2016-10128 (GCVE-0-2016-10128)

Vulnerability from cvelistv5

Published

2017-03-24 15:00

Modified

2024-08-06 03:14

Severity ?

Summary

Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/95338	vdb-entry, x_refsource_BID
	https://libgit2.github.com/security/	x_refsource_CONFIRM
	https://github.com/libgit2/libgit2/commit/66e3774d279672ee51c3b54545a79d20d1ada834	x_refsource_CONFIRM
	https://github.com/libgit2/libgit2/commit/4ac39c76c0153d1ee6889a0984c39e97731684b2	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2017/01/10/5	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2017/01/11/6	mailing-list, x_refsource_MLIST
	http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T03:14:42.380Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "95338",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/95338",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://libgit2.github.com/security/",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/libgit2/libgit2/commit/66e3774d279672ee51c3b54545a79d20d1ada834",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/libgit2/libgit2/commit/4ac39c76c0153d1ee6889a0984c39e97731684b2",
               },
               {
                  name: "[oss-security] 20170110 CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2017/01/10/5",
               },
               {
                  name: "[oss-security] 20170110 Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2017/01/11/6",
               },
               {
                  name: "openSUSE-SU-2017:0397",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html",
               },
               {
                  name: "openSUSE-SU-2017:0405",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html",
               },
               {
                  name: "openSUSE-SU-2017:0484",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2017-01-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-03-27T09:57:01",
            orgId: "79363d38-fa19-49d1-9214-5f28da3f3ac5",
            shortName: "debian",
         },
         references: [
            {
               name: "95338",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/95338",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://libgit2.github.com/security/",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/libgit2/libgit2/commit/66e3774d279672ee51c3b54545a79d20d1ada834",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/libgit2/libgit2/commit/4ac39c76c0153d1ee6889a0984c39e97731684b2",
            },
            {
               name: "[oss-security] 20170110 CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2017/01/10/5",
            },
            {
               name: "[oss-security] 20170110 Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2017/01/11/6",
            },
            {
               name: "openSUSE-SU-2017:0397",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html",
            },
            {
               name: "openSUSE-SU-2017:0405",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html",
            },
            {
               name: "openSUSE-SU-2017:0484",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@debian.org",
               ID: "CVE-2016-10128",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "95338",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/95338",
                  },
                  {
                     name: "https://libgit2.github.com/security/",
                     refsource: "CONFIRM",
                     url: "https://libgit2.github.com/security/",
                  },
                  {
                     name: "https://github.com/libgit2/libgit2/commit/66e3774d279672ee51c3b54545a79d20d1ada834",
                     refsource: "CONFIRM",
                     url: "https://github.com/libgit2/libgit2/commit/66e3774d279672ee51c3b54545a79d20d1ada834",
                  },
                  {
                     name: "https://github.com/libgit2/libgit2/commit/4ac39c76c0153d1ee6889a0984c39e97731684b2",
                     refsource: "CONFIRM",
                     url: "https://github.com/libgit2/libgit2/commit/4ac39c76c0153d1ee6889a0984c39e97731684b2",
                  },
                  {
                     name: "[oss-security] 20170110 CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2017/01/10/5",
                  },
                  {
                     name: "[oss-security] 20170110 Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2017/01/11/6",
                  },
                  {
                     name: "openSUSE-SU-2017:0397",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html",
                  },
                  {
                     name: "openSUSE-SU-2017:0405",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html",
                  },
                  {
                     name: "openSUSE-SU-2017:0484",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "79363d38-fa19-49d1-9214-5f28da3f3ac5",
      assignerShortName: "debian",
      cveId: "CVE-2016-10128",
      datePublished: "2017-03-24T15:00:00",
      dateReserved: "2017-01-10T00:00:00",
      dateUpdated: "2024-08-06T03:14:42.380Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2016-10130 (GCVE-0-2016-10130)

Vulnerability from cvelistv5

Published

2017-03-24 15:00

Modified

2024-08-06 03:14

Severity ?

Summary

The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.

References

▼	URL	Tags
	https://libgit2.github.com/security/	x_refsource_CONFIRM
	http://www.openwall.com/lists/oss-security/2017/01/10/5	mailing-list, x_refsource_MLIST
	http://www.openwall.com/lists/oss-security/2017/01/11/6	mailing-list, x_refsource_MLIST
	http://www.securityfocus.com/bid/95359	vdb-entry, x_refsource_BID
	https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html	vendor-advisory, x_refsource_SUSE
	http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html	vendor-advisory, x_refsource_SUSE
	https://github.com/libgit2/libgit2/commit/b5c6a1b407b7f8b952bded2789593b68b1876211	x_refsource_CONFIRM
	http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-06T03:14:41.339Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://libgit2.github.com/security/",
               },
               {
                  name: "[oss-security] 20170110 CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2017/01/10/5",
               },
               {
                  name: "[oss-security] 20170110 Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
                  tags: [
                     "mailing-list",
                     "x_refsource_MLIST",
                     "x_transferred",
                  ],
                  url: "http://www.openwall.com/lists/oss-security/2017/01/11/6",
               },
               {
                  name: "95359",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/95359",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22",
               },
               {
                  name: "openSUSE-SU-2017:0397",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html",
               },
               {
                  name: "openSUSE-SU-2017:0405",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html",
               },
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://github.com/libgit2/libgit2/commit/b5c6a1b407b7f8b952bded2789593b68b1876211",
               },
               {
                  name: "openSUSE-SU-2017:0484",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2017-01-09T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2017-03-27T09:57:01",
            orgId: "79363d38-fa19-49d1-9214-5f28da3f3ac5",
            shortName: "debian",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://libgit2.github.com/security/",
            },
            {
               name: "[oss-security] 20170110 CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2017/01/10/5",
            },
            {
               name: "[oss-security] 20170110 Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
               tags: [
                  "mailing-list",
                  "x_refsource_MLIST",
               ],
               url: "http://www.openwall.com/lists/oss-security/2017/01/11/6",
            },
            {
               name: "95359",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/95359",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22",
            },
            {
               name: "openSUSE-SU-2017:0397",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html",
            },
            {
               name: "openSUSE-SU-2017:0405",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html",
            },
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://github.com/libgit2/libgit2/commit/b5c6a1b407b7f8b952bded2789593b68b1876211",
            },
            {
               name: "openSUSE-SU-2017:0484",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "security@debian.org",
               ID: "CVE-2016-10130",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://libgit2.github.com/security/",
                     refsource: "CONFIRM",
                     url: "https://libgit2.github.com/security/",
                  },
                  {
                     name: "[oss-security] 20170110 CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2017/01/10/5",
                  },
                  {
                     name: "[oss-security] 20170110 Re: CVE Request: two security fixes in libgit2 0.25.1, 0.24.6",
                     refsource: "MLIST",
                     url: "http://www.openwall.com/lists/oss-security/2017/01/11/6",
                  },
                  {
                     name: "95359",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/95359",
                  },
                  {
                     name: "https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22",
                     refsource: "CONFIRM",
                     url: "https://github.com/libgit2/libgit2/commit/9a64e62f0f20c9cf9b2e1609f037060eb2d8eb22",
                  },
                  {
                     name: "openSUSE-SU-2017:0397",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00030.html",
                  },
                  {
                     name: "openSUSE-SU-2017:0405",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00036.html",
                  },
                  {
                     name: "https://github.com/libgit2/libgit2/commit/b5c6a1b407b7f8b952bded2789593b68b1876211",
                     refsource: "CONFIRM",
                     url: "https://github.com/libgit2/libgit2/commit/b5c6a1b407b7f8b952bded2789593b68b1876211",
                  },
                  {
                     name: "openSUSE-SU-2017:0484",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-updates/2017-02/msg00072.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "79363d38-fa19-49d1-9214-5f28da3f3ac5",
      assignerShortName: "debian",
      cveId: "CVE-2016-10130",
      datePublished: "2017-03-24T15:00:00",
      dateReserved: "2017-01-10T00:00:00",
      dateUpdated: "2024-08-06T03:14:41.339Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2019-1349 (GCVE-0-2019-1349)

Vulnerability from cvelistv5

Published

2020-01-24 20:50

Modified

2024-08-04 18:13

Severity ?

Summary

A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349	x_refsource_MISC
	https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0228	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/202003-30	vendor-advisory, x_refsource_GENTOO
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	vendor-advisory, x_refsource_SUSE

Impacted products

Vendor

Product

Version

▼

Microsoft

Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)

Version: unspecified

Microsoft	Microsoft Visual Studio 2017	Version: 15.0
Microsoft	Microsoft Visual Studio 2019	Version: 16.0
Microsoft	Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)	Version: unspecified

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T18:13:30.511Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
               },
               {
                  name: "openSUSE-SU-2020:0123",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
               },
               {
                  name: "RHSA-2020:0228",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2020:0228",
               },
               {
                  name: "GLSA-202003-30",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-30",
               },
               {
                  name: "openSUSE-SU-2020:0598",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "unspecified",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2017",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "15.0",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2019",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "16.0",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "unspecified",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Remote Code Execution",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-05-01T23:06:04",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
            },
            {
               name: "openSUSE-SU-2020:0123",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
            },
            {
               name: "RHSA-2020:0228",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2020:0228",
            },
            {
               name: "GLSA-202003-30",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-30",
            },
            {
               name: "openSUSE-SU-2020:0598",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secure@microsoft.com",
               ID: "CVE-2019-1349",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2017",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "15.0",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2019",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "16.0",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Microsoft",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Remote Code Execution",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349",
                     refsource: "MISC",
                     url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1349",
                  },
                  {
                     name: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                     refsource: "MISC",
                     url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                  },
                  {
                     name: "openSUSE-SU-2020:0123",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
                  },
                  {
                     name: "RHSA-2020:0228",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2020:0228",
                  },
                  {
                     name: "GLSA-202003-30",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-30",
                  },
                  {
                     name: "openSUSE-SU-2020:0598",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2019-1349",
      datePublished: "2020-01-24T20:50:25",
      dateReserved: "2018-11-26T00:00:00",
      dateUpdated: "2024-08-04T18:13:30.511Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2019-1348 (GCVE-0-2019-1348)

Vulnerability from cvelistv5

Published

2020-01-24 21:14

Modified

2024-08-04 18:13

Severity ?

Summary

An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.

References

▼	URL	Tags
	https://support.apple.com/kb/HT210729	x_refsource_CONFIRM
	https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u	x_refsource_MISC
	https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0228	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/202003-30	vendor-advisory, x_refsource_GENTOO
	https://security.gentoo.org/glsa/202003-42	vendor-advisory, x_refsource_GENTOO
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	Microsoft Corporation	Git	Version: Before 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, 2.14.6

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T18:13:30.521Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_CONFIRM",
                     "x_transferred",
                  ],
                  url: "https://support.apple.com/kb/HT210729",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
               },
               {
                  name: "openSUSE-SU-2020:0123",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
               },
               {
                  name: "RHSA-2020:0228",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2020:0228",
               },
               {
                  name: "GLSA-202003-30",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-30",
               },
               {
                  name: "GLSA-202003-42",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-42",
               },
               {
                  name: "openSUSE-SU-2020:0598",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Git",
               vendor: "Microsoft Corporation",
               versions: [
                  {
                     status: "affected",
                     version: "Before 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, 2.14.6",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Remote Code Execution",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-05-01T23:06:07",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               tags: [
                  "x_refsource_CONFIRM",
               ],
               url: "https://support.apple.com/kb/HT210729",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://lore.kernel.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/T/#u",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
            },
            {
               name: "openSUSE-SU-2020:0123",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
            },
            {
               name: "RHSA-2020:0228",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2020:0228",
            },
            {
               name: "GLSA-202003-30",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-30",
            },
            {
               name: "GLSA-202003-42",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-42",
            },
            {
               name: "openSUSE-SU-2020:0598",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secure@microsoft.com",
               ID: "CVE-2019-1348",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Git",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "Before 2.24.1, 2.23.1, 2.22.2, 2.21.1, 2.20.2, 2.19.3, 2.18.2, 2.17.3, 2.16.6, 2.15.4, 2.14.6",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Microsoft Corporation",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The --export-marks option of git fast-import is exposed also via the in-stream command feature export-marks=... and it allows overwriting arbitrary paths.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Remote Code Execution",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://support.apple.com/kb/HT210729",
                     refsource: "CONFIRM",
                     url: "https://support.apple.com/kb/HT210729",
                  },
                  {
                     name: "https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/T/#u",
                     refsource: "MISC",
                     url: "https://lore.kernel.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/T/#u",
                  },
                  {
                     name: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                     refsource: "MISC",
                     url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                  },
                  {
                     name: "openSUSE-SU-2020:0123",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
                  },
                  {
                     name: "RHSA-2020:0228",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2020:0228",
                  },
                  {
                     name: "GLSA-202003-30",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-30",
                  },
                  {
                     name: "GLSA-202003-42",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-42",
                  },
                  {
                     name: "openSUSE-SU-2020:0598",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2019-1348",
      datePublished: "2020-01-24T21:14:21",
      dateReserved: "2018-11-26T00:00:00",
      dateUpdated: "2024-08-04T18:13:30.521Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2019-1354 (GCVE-0-2019-1354)

Vulnerability from cvelistv5

Published

2020-01-24 20:50

Modified

2024-08-04 18:13

Severity ?

Summary

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354	x_refsource_MISC
	https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202003-30	vendor-advisory, x_refsource_GENTOO
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	vendor-advisory, x_refsource_SUSE

Impacted products

Vendor

Product

Version

▼

Microsoft

Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)

Version: unspecified

Microsoft	Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)	Version: unspecified
Microsoft	Microsoft Visual Studio 2017	Version: 15.0
Microsoft	Microsoft Visual Studio 2019	Version: 16.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T18:13:30.502Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
               },
               {
                  name: "openSUSE-SU-2020:0123",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
               },
               {
                  name: "GLSA-202003-30",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-30",
               },
               {
                  name: "openSUSE-SU-2020:0598",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "unspecified",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "unspecified",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2017",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "15.0",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2019",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "16.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Remote Code Execution",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-05-01T23:06:07",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
            },
            {
               name: "openSUSE-SU-2020:0123",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
            },
            {
               name: "GLSA-202003-30",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-30",
            },
            {
               name: "openSUSE-SU-2020:0598",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secure@microsoft.com",
               ID: "CVE-2019-1354",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2017",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "15.0",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2019",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "16.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Microsoft",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Remote Code Execution",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354",
                     refsource: "MISC",
                     url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1354",
                  },
                  {
                     name: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                     refsource: "MISC",
                     url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                  },
                  {
                     name: "openSUSE-SU-2020:0123",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
                  },
                  {
                     name: "GLSA-202003-30",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-30",
                  },
                  {
                     name: "openSUSE-SU-2020:0598",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2019-1354",
      datePublished: "2020-01-24T20:50:26",
      dateReserved: "2018-11-26T00:00:00",
      dateUpdated: "2024-08-04T18:13:30.502Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2019-1350 (GCVE-0-2019-1350)

Vulnerability from cvelistv5

Published

2020-01-24 20:50

Modified

2024-08-04 18:13

Severity ?

Summary

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350	x_refsource_MISC
	https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	vendor-advisory, x_refsource_SUSE
	https://security.gentoo.org/glsa/202003-30	vendor-advisory, x_refsource_GENTOO
	https://security.gentoo.org/glsa/202003-42	vendor-advisory, x_refsource_GENTOO
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	vendor-advisory, x_refsource_SUSE

Impacted products

Vendor

Product

Version

▼

Microsoft

Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)

Version: unspecified

Microsoft	Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)	Version: unspecified
Microsoft	Microsoft Visual Studio 2017	Version: 15.0
Microsoft	Microsoft Visual Studio 2019	Version: 16.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T18:13:30.492Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
               },
               {
                  name: "openSUSE-SU-2020:0123",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
               },
               {
                  name: "GLSA-202003-30",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-30",
               },
               {
                  name: "GLSA-202003-42",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-42",
               },
               {
                  name: "openSUSE-SU-2020:0598",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "unspecified",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "unspecified",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2017",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "15.0",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2019",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "16.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Remote Code Execution",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-05-01T23:06:08",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
            },
            {
               name: "openSUSE-SU-2020:0123",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
            },
            {
               name: "GLSA-202003-30",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-30",
            },
            {
               name: "GLSA-202003-42",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-42",
            },
            {
               name: "openSUSE-SU-2020:0598",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secure@microsoft.com",
               ID: "CVE-2019-1350",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2017",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "15.0",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2019",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "16.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Microsoft",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Remote Code Execution",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350",
                     refsource: "MISC",
                     url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1350",
                  },
                  {
                     name: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                     refsource: "MISC",
                     url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                  },
                  {
                     name: "openSUSE-SU-2020:0123",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
                  },
                  {
                     name: "GLSA-202003-30",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-30",
                  },
                  {
                     name: "GLSA-202003-42",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-42",
                  },
                  {
                     name: "openSUSE-SU-2020:0598",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2019-1350",
      datePublished: "2020-01-24T20:50:25",
      dateReserved: "2018-11-26T00:00:00",
      dateUpdated: "2024-08-04T18:13:30.492Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2018-17456 (GCVE-0-2018-17456)

Vulnerability from cvelistv5

Published

2018-10-06 14:00

Modified

2024-08-05 10:47

Severity ?

Summary

Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.

References

▼	URL	Tags
	https://www.exploit-db.com/exploits/45631/	exploit, x_refsource_EXPLOIT-DB
	http://www.securityfocus.com/bid/105523	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1041811	vdb-entry, x_refsource_SECTRACK
	https://www.debian.org/security/2018/dsa-4311	vendor-advisory, x_refsource_DEBIAN
	https://access.redhat.com/errata/RHSA-2018:3505	vendor-advisory, x_refsource_REDHAT
	https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404	x_refsource_MISC
	https://www.exploit-db.com/exploits/45548/	exploit, x_refsource_EXPLOIT-DB
	https://access.redhat.com/errata/RHSA-2018:3541	vendor-advisory, x_refsource_REDHAT
	https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2018:3408	vendor-advisory, x_refsource_REDHAT
	https://marc.info/?l=git&m=153875888916397&w=2	x_refsource_MISC
	https://www.openwall.com/lists/oss-security/2018/10/06/3	x_refsource_MISC
	https://usn.ubuntu.com/3791-1/	vendor-advisory, x_refsource_UBUNTU
	https://seclists.org/bugtraq/2019/Mar/30	mailing-list, x_refsource_BUGTRAQ
	http://www.securityfocus.com/bid/107511	vdb-entry, x_refsource_BID
	http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html	x_refsource_MISC
	https://access.redhat.com/errata/RHSA-2020:0316	vendor-advisory, x_refsource_REDHAT
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T10:47:04.938Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "45631",
                  tags: [
                     "exploit",
                     "x_refsource_EXPLOIT-DB",
                     "x_transferred",
                  ],
                  url: "https://www.exploit-db.com/exploits/45631/",
               },
               {
                  name: "105523",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/105523",
               },
               {
                  name: "1041811",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1041811",
               },
               {
                  name: "DSA-4311",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4311",
               },
               {
                  name: "RHSA-2018:3505",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3505",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404",
               },
               {
                  name: "45548",
                  tags: [
                     "exploit",
                     "x_refsource_EXPLOIT-DB",
                     "x_transferred",
                  ],
                  url: "https://www.exploit-db.com/exploits/45548/",
               },
               {
                  name: "RHSA-2018:3541",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3541",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46",
               },
               {
                  name: "RHSA-2018:3408",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:3408",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://marc.info/?l=git&m=153875888916397&w=2",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://www.openwall.com/lists/oss-security/2018/10/06/3",
               },
               {
                  name: "USN-3791-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3791-1/",
               },
               {
                  name: "20190320 March 2019 Sourcetree Advisory - Multiple Remote Code Execution Vulnerabilities",
                  tags: [
                     "mailing-list",
                     "x_refsource_BUGTRAQ",
                     "x_transferred",
                  ],
                  url: "https://seclists.org/bugtraq/2019/Mar/30",
               },
               {
                  name: "107511",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/107511",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html",
               },
               {
                  name: "RHSA-2020:0316",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2020:0316",
               },
               {
                  name: "openSUSE-SU-2020:0598",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-10-06T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-05-01T23:06:05",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "45631",
               tags: [
                  "exploit",
                  "x_refsource_EXPLOIT-DB",
               ],
               url: "https://www.exploit-db.com/exploits/45631/",
            },
            {
               name: "105523",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/105523",
            },
            {
               name: "1041811",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1041811",
            },
            {
               name: "DSA-4311",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4311",
            },
            {
               name: "RHSA-2018:3505",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3505",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404",
            },
            {
               name: "45548",
               tags: [
                  "exploit",
                  "x_refsource_EXPLOIT-DB",
               ],
               url: "https://www.exploit-db.com/exploits/45548/",
            },
            {
               name: "RHSA-2018:3541",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3541",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46",
            },
            {
               name: "RHSA-2018:3408",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:3408",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://marc.info/?l=git&m=153875888916397&w=2",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://www.openwall.com/lists/oss-security/2018/10/06/3",
            },
            {
               name: "USN-3791-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3791-1/",
            },
            {
               name: "20190320 March 2019 Sourcetree Advisory - Multiple Remote Code Execution Vulnerabilities",
               tags: [
                  "mailing-list",
                  "x_refsource_BUGTRAQ",
               ],
               url: "https://seclists.org/bugtraq/2019/Mar/30",
            },
            {
               name: "107511",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/107511",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html",
            },
            {
               name: "RHSA-2020:0316",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2020:0316",
            },
            {
               name: "openSUSE-SU-2020:0598",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2018-17456",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive \"git clone\" of a superproject if a .gitmodules file has a URL field beginning with a '-' character.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "45631",
                     refsource: "EXPLOIT-DB",
                     url: "https://www.exploit-db.com/exploits/45631/",
                  },
                  {
                     name: "105523",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/105523",
                  },
                  {
                     name: "1041811",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1041811",
                  },
                  {
                     name: "DSA-4311",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4311",
                  },
                  {
                     name: "RHSA-2018:3505",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3505",
                  },
                  {
                     name: "https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404",
                     refsource: "MISC",
                     url: "https://github.com/git/git/commit/1a7fd1fb2998002da6e9ff2ee46e1bdd25ee8404",
                  },
                  {
                     name: "45548",
                     refsource: "EXPLOIT-DB",
                     url: "https://www.exploit-db.com/exploits/45548/",
                  },
                  {
                     name: "RHSA-2018:3541",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3541",
                  },
                  {
                     name: "https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46",
                     refsource: "MISC",
                     url: "https://github.com/git/git/commit/a124133e1e6ab5c7a9fef6d0e6bcb084e3455b46",
                  },
                  {
                     name: "RHSA-2018:3408",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:3408",
                  },
                  {
                     name: "https://marc.info/?l=git&m=153875888916397&w=2",
                     refsource: "MISC",
                     url: "https://marc.info/?l=git&m=153875888916397&w=2",
                  },
                  {
                     name: "https://www.openwall.com/lists/oss-security/2018/10/06/3",
                     refsource: "MISC",
                     url: "https://www.openwall.com/lists/oss-security/2018/10/06/3",
                  },
                  {
                     name: "USN-3791-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3791-1/",
                  },
                  {
                     name: "20190320 March 2019 Sourcetree Advisory - Multiple Remote Code Execution Vulnerabilities",
                     refsource: "BUGTRAQ",
                     url: "https://seclists.org/bugtraq/2019/Mar/30",
                  },
                  {
                     name: "107511",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/107511",
                  },
                  {
                     name: "http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html",
                     refsource: "MISC",
                     url: "http://packetstormsecurity.com/files/152173/Sourcetree-Git-Arbitrary-Code-Execution-URL-Handling.html",
                  },
                  {
                     name: "RHSA-2020:0316",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2020:0316",
                  },
                  {
                     name: "openSUSE-SU-2020:0598",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2018-17456",
      datePublished: "2018-10-06T14:00:00",
      dateReserved: "2018-09-25T00:00:00",
      dateUpdated: "2024-08-05T10:47:04.938Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2019-1352 (GCVE-0-2019-1352)

Vulnerability from cvelistv5

Published

2020-01-24 20:50

Modified

2024-08-04 18:13

Severity ?

Summary

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352	x_refsource_MISC
	https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/	x_refsource_MISC
	http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html	vendor-advisory, x_refsource_SUSE
	https://access.redhat.com/errata/RHSA-2020:0228	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/202003-30	vendor-advisory, x_refsource_GENTOO
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	vendor-advisory, x_refsource_SUSE

Impacted products

Vendor

Product

Version

▼

Microsoft

Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)

Version: unspecified

Microsoft	Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)	Version: unspecified
Microsoft	Microsoft Visual Studio 2017	Version: 15.0
Microsoft	Microsoft Visual Studio 2019	Version: 16.0

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-04T18:13:30.495Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
               },
               {
                  name: "openSUSE-SU-2020:0123",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
               },
               {
                  name: "RHSA-2020:0228",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2020:0228",
               },
               {
                  name: "GLSA-202003-30",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/202003-30",
               },
               {
                  name: "openSUSE-SU-2020:0598",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "unspecified",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "unspecified",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2017",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "15.0",
                  },
               ],
            },
            {
               product: "Microsoft Visual Studio 2019",
               vendor: "Microsoft",
               versions: [
                  {
                     status: "affected",
                     version: "16.0",
                  },
               ],
            },
         ],
         descriptions: [
            {
               lang: "en",
               value: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "Remote Code Execution",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-05-01T23:06:06",
            orgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
            shortName: "microsoft",
         },
         references: [
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf%40gitster-ct.c.googlers.com/",
            },
            {
               name: "openSUSE-SU-2020:0123",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
            },
            {
               name: "RHSA-2020:0228",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2020:0228",
            },
            {
               name: "GLSA-202003-30",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/202003-30",
            },
            {
               name: "openSUSE-SU-2020:0598",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "secure@microsoft.com",
               ID: "CVE-2019-1352",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "Microsoft Visual Studio 2019 version 16.4 (includes 16.0 - 16.3)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2017 version 15.9 (includes 15.1 - 15.8)",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2017",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "15.0",
                                       },
                                    ],
                                 },
                              },
                              {
                                 product_name: "Microsoft Visual Studio 2019",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "16.0",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "Microsoft",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "Remote Code Execution",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352",
                     refsource: "MISC",
                     url: "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1352",
                  },
                  {
                     name: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                     refsource: "MISC",
                     url: "https://public-inbox.org/git/xmqqr21cqcn9.fsf@gitster-ct.c.googlers.com/",
                  },
                  {
                     name: "openSUSE-SU-2020:0123",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00056.html",
                  },
                  {
                     name: "RHSA-2020:0228",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2020:0228",
                  },
                  {
                     name: "GLSA-202003-30",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/202003-30",
                  },
                  {
                     name: "openSUSE-SU-2020:0598",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
      assignerShortName: "microsoft",
      cveId: "CVE-2019-1352",
      datePublished: "2020-01-24T20:50:26",
      dateReserved: "2018-11-26T00:00:00",
      dateUpdated: "2024-08-04T18:13:30.495Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

CVE-2018-11235 (GCVE-0-2018-11235)

Vulnerability from cvelistv5

Published

2018-05-30 04:00

Modified

2024-08-05 08:01

Severity ?

Summary

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with "../" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.

References

▼	URL	Tags
	https://www.exploit-db.com/exploits/44822/	exploit, x_refsource_EXPLOIT-DB
	https://access.redhat.com/errata/RHSA-2018:2147	vendor-advisory, x_refsource_REDHAT
	https://usn.ubuntu.com/3671-1/	vendor-advisory, x_refsource_UBUNTU
	https://marc.info/?l=git&m=152761328506724&w=2	x_refsource_MISC
	http://www.securitytracker.com/id/1040991	vdb-entry, x_refsource_SECTRACK
	https://access.redhat.com/errata/RHSA-2018:1957	vendor-advisory, x_refsource_REDHAT
	https://security.gentoo.org/glsa/201805-13	vendor-advisory, x_refsource_GENTOO
	http://www.securityfocus.com/bid/104345	vdb-entry, x_refsource_BID
	https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/	x_refsource_MISC
	https://www.debian.org/security/2018/dsa-4212	vendor-advisory, x_refsource_DEBIAN
	http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html	vendor-advisory, x_refsource_SUSE

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
   containers: {
      adp: [
         {
            providerMetadata: {
               dateUpdated: "2024-08-05T08:01:52.808Z",
               orgId: "af854a3a-2127-422b-91ae-364da2661108",
               shortName: "CVE",
            },
            references: [
               {
                  name: "44822",
                  tags: [
                     "exploit",
                     "x_refsource_EXPLOIT-DB",
                     "x_transferred",
                  ],
                  url: "https://www.exploit-db.com/exploits/44822/",
               },
               {
                  name: "RHSA-2018:2147",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:2147",
               },
               {
                  name: "USN-3671-1",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_UBUNTU",
                     "x_transferred",
                  ],
                  url: "https://usn.ubuntu.com/3671-1/",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://marc.info/?l=git&m=152761328506724&w=2",
               },
               {
                  name: "1040991",
                  tags: [
                     "vdb-entry",
                     "x_refsource_SECTRACK",
                     "x_transferred",
                  ],
                  url: "http://www.securitytracker.com/id/1040991",
               },
               {
                  name: "RHSA-2018:1957",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_REDHAT",
                     "x_transferred",
                  ],
                  url: "https://access.redhat.com/errata/RHSA-2018:1957",
               },
               {
                  name: "GLSA-201805-13",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_GENTOO",
                     "x_transferred",
                  ],
                  url: "https://security.gentoo.org/glsa/201805-13",
               },
               {
                  name: "104345",
                  tags: [
                     "vdb-entry",
                     "x_refsource_BID",
                     "x_transferred",
                  ],
                  url: "http://www.securityfocus.com/bid/104345",
               },
               {
                  tags: [
                     "x_refsource_MISC",
                     "x_transferred",
                  ],
                  url: "https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/",
               },
               {
                  name: "DSA-4212",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_DEBIAN",
                     "x_transferred",
                  ],
                  url: "https://www.debian.org/security/2018/dsa-4212",
               },
               {
                  name: "openSUSE-SU-2020:0598",
                  tags: [
                     "vendor-advisory",
                     "x_refsource_SUSE",
                     "x_transferred",
                  ],
                  url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
               },
            ],
            title: "CVE Program Container",
         },
      ],
      cna: {
         affected: [
            {
               product: "n/a",
               vendor: "n/a",
               versions: [
                  {
                     status: "affected",
                     version: "n/a",
                  },
               ],
            },
         ],
         datePublic: "2018-05-29T00:00:00",
         descriptions: [
            {
               lang: "en",
               value: "In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs \"git clone --recurse-submodules\" because submodule \"names\" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with \"../\" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.",
            },
         ],
         problemTypes: [
            {
               descriptions: [
                  {
                     description: "n/a",
                     lang: "en",
                     type: "text",
                  },
               ],
            },
         ],
         providerMetadata: {
            dateUpdated: "2020-05-01T23:06:09",
            orgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
            shortName: "mitre",
         },
         references: [
            {
               name: "44822",
               tags: [
                  "exploit",
                  "x_refsource_EXPLOIT-DB",
               ],
               url: "https://www.exploit-db.com/exploits/44822/",
            },
            {
               name: "RHSA-2018:2147",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:2147",
            },
            {
               name: "USN-3671-1",
               tags: [
                  "vendor-advisory",
                  "x_refsource_UBUNTU",
               ],
               url: "https://usn.ubuntu.com/3671-1/",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://marc.info/?l=git&m=152761328506724&w=2",
            },
            {
               name: "1040991",
               tags: [
                  "vdb-entry",
                  "x_refsource_SECTRACK",
               ],
               url: "http://www.securitytracker.com/id/1040991",
            },
            {
               name: "RHSA-2018:1957",
               tags: [
                  "vendor-advisory",
                  "x_refsource_REDHAT",
               ],
               url: "https://access.redhat.com/errata/RHSA-2018:1957",
            },
            {
               name: "GLSA-201805-13",
               tags: [
                  "vendor-advisory",
                  "x_refsource_GENTOO",
               ],
               url: "https://security.gentoo.org/glsa/201805-13",
            },
            {
               name: "104345",
               tags: [
                  "vdb-entry",
                  "x_refsource_BID",
               ],
               url: "http://www.securityfocus.com/bid/104345",
            },
            {
               tags: [
                  "x_refsource_MISC",
               ],
               url: "https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/",
            },
            {
               name: "DSA-4212",
               tags: [
                  "vendor-advisory",
                  "x_refsource_DEBIAN",
               ],
               url: "https://www.debian.org/security/2018/dsa-4212",
            },
            {
               name: "openSUSE-SU-2020:0598",
               tags: [
                  "vendor-advisory",
                  "x_refsource_SUSE",
               ],
               url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
            },
         ],
         x_legacyV4Record: {
            CVE_data_meta: {
               ASSIGNER: "cve@mitre.org",
               ID: "CVE-2018-11235",
               STATE: "PUBLIC",
            },
            affects: {
               vendor: {
                  vendor_data: [
                     {
                        product: {
                           product_data: [
                              {
                                 product_name: "n/a",
                                 version: {
                                    version_data: [
                                       {
                                          version_value: "n/a",
                                       },
                                    ],
                                 },
                              },
                           ],
                        },
                        vendor_name: "n/a",
                     },
                  ],
               },
            },
            data_format: "MITRE",
            data_type: "CVE",
            data_version: "4.0",
            description: {
               description_data: [
                  {
                     lang: "eng",
                     value: "In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs \"git clone --recurse-submodules\" because submodule \"names\" are obtained from this file, and then appended to $GIT_DIR/modules, leading to directory traversal with \"../\" in a name. Finally, post-checkout hooks from a submodule are executed, bypassing the intended design in which hooks are not obtained from a remote server.",
                  },
               ],
            },
            problemtype: {
               problemtype_data: [
                  {
                     description: [
                        {
                           lang: "eng",
                           value: "n/a",
                        },
                     ],
                  },
               ],
            },
            references: {
               reference_data: [
                  {
                     name: "44822",
                     refsource: "EXPLOIT-DB",
                     url: "https://www.exploit-db.com/exploits/44822/",
                  },
                  {
                     name: "RHSA-2018:2147",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:2147",
                  },
                  {
                     name: "USN-3671-1",
                     refsource: "UBUNTU",
                     url: "https://usn.ubuntu.com/3671-1/",
                  },
                  {
                     name: "https://marc.info/?l=git&m=152761328506724&w=2",
                     refsource: "MISC",
                     url: "https://marc.info/?l=git&m=152761328506724&w=2",
                  },
                  {
                     name: "1040991",
                     refsource: "SECTRACK",
                     url: "http://www.securitytracker.com/id/1040991",
                  },
                  {
                     name: "RHSA-2018:1957",
                     refsource: "REDHAT",
                     url: "https://access.redhat.com/errata/RHSA-2018:1957",
                  },
                  {
                     name: "GLSA-201805-13",
                     refsource: "GENTOO",
                     url: "https://security.gentoo.org/glsa/201805-13",
                  },
                  {
                     name: "104345",
                     refsource: "BID",
                     url: "http://www.securityfocus.com/bid/104345",
                  },
                  {
                     name: "https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/",
                     refsource: "MISC",
                     url: "https://blogs.msdn.microsoft.com/devops/2018/05/29/announcing-the-may-2018-git-security-vulnerability/",
                  },
                  {
                     name: "DSA-4212",
                     refsource: "DEBIAN",
                     url: "https://www.debian.org/security/2018/dsa-4212",
                  },
                  {
                     name: "openSUSE-SU-2020:0598",
                     refsource: "SUSE",
                     url: "http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html",
                  },
               ],
            },
         },
      },
   },
   cveMetadata: {
      assignerOrgId: "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
      assignerShortName: "mitre",
      cveId: "CVE-2018-11235",
      datePublished: "2018-05-30T04:00:00",
      dateReserved: "2018-05-18T00:00:00",
      dateUpdated: "2024-08-05T08:01:52.808Z",
      state: "PUBLISHED",
   },
   dataType: "CVE_RECORD",
   dataVersion: "5.1",
}

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

Vulnerability from csaf_opensuse

CVE-2019-1353 (GCVE-0-2019-1353)

Vulnerability from cvelistv5

CVE-2019-1387 (GCVE-0-2019-1387)

Vulnerability from cvelistv5

CVE-2018-10887 (GCVE-0-2018-10887)

Vulnerability from cvelistv5

CVE-2005-4900 (GCVE-0-2005-4900)

Vulnerability from cvelistv5

CVE-2019-1351 (GCVE-0-2019-1351)

Vulnerability from cvelistv5

CVE-2018-8098 (GCVE-0-2018-8098)

Vulnerability from cvelistv5

CVE-2016-10128 (GCVE-0-2016-10128)

Vulnerability from cvelistv5

CVE-2016-10130 (GCVE-0-2016-10130)

Vulnerability from cvelistv5

CVE-2019-1349 (GCVE-0-2019-1349)

Vulnerability from cvelistv5

CVE-2019-1348 (GCVE-0-2019-1348)

Vulnerability from cvelistv5

CVE-2019-1354 (GCVE-0-2019-1354)

Vulnerability from cvelistv5

CVE-2019-1350 (GCVE-0-2019-1350)

Vulnerability from cvelistv5

CVE-2018-17456 (GCVE-0-2018-17456)

Vulnerability from cvelistv5

CVE-2019-1352 (GCVE-0-2019-1352)

Vulnerability from cvelistv5

CVE-2018-11235 (GCVE-0-2018-11235)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature