Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service via a crafted repository index file.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libgit2 | Mar 9, 2022 | Mar 14, 2018 |
| Suse | — | Upgrade libgit2-26Upgrade libgit2-24Upgrade libgit2-28Upgrade libgit2-devel | May 19, 2018 | Mar 13, 2018 |
| Ubuntu | — | Upgrade libgit2-26 (Ubuntu Pro)Upgrade libgit2-28 (Ubuntu Pro)Upgrade libgit2-devUpgrade libgit2-fixtures (Ubuntu Pro)No solution existsUpgrade libgit2-1.7Upgrade libgit2-1.9Upgrade libgit2-fixturesUpgrade libgit2-24 (Ubuntu Pro)Upgrade libgit2-0 (Ubuntu Pro)Upgrade libgit2-1.1 (Ubuntu Pro)Upgrade libgit2-dev (Ubuntu Pro) | Jun 26, 2025 | Mar 14, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub