CVE-2018-11233

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 54%
Affected Products (NVD)
VendorProductVersion
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
17.10
canonicalubuntu_linux
18.04
git-scmgit
𝑥
≤ 2.13.6
git-scmgit
2.14.0 ≤
𝑥
≤ 2.14.3
git-scmgit
2.15.0 ≤
𝑥
≤ 2.15.1
git-scmgit
2.16.0 ≤
𝑥
≤ 2.16.3
git-scmgit
2.17.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
git
bookworm
1:2.39.2-1.1
fixed
bookworm (security)
1:2.39.5-0+deb12u1
fixed
bullseye
1:2.30.2-1+deb11u2
fixed
bullseye (security)
1:2.30.2-1+deb11u3
fixed
sid
1:2.45.2-1.1
fixed
trixie
1:2.45.2-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
git
artful
Fixed 1:2.14.1-1ubuntu4.1
released
bionic
Fixed 1:2.17.1-1ubuntu0.1
released
trusty
Fixed 1:1.9.1-1ubuntu0.8
released
xenial
Fixed 1:2.7.4-0ubuntu1.4
released
openSUSE logo
openSUSE / SLES Releases
openSUSE Product
Release
git
suse enterprise desktop 15
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP1
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP2
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP3
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise desktop 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise desktop 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise desktop 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise sap 15
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP1
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP2
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP3
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise sap 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise sap 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise sap 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise server 15
2.16.4-3.3.2
fixed
suse enterprise server 15 SP1
2.16.4-3.3.2
fixed
suse enterprise server 15 SP2
2.26.1-3.25.2
fixed
suse enterprise server 15 SP3
2.26.1-3.25.2
fixed
suse enterprise server 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise server 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise server 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise server 15 SP7
2.43.0-150600.3.9.1
fixed
git-arch
suse enterprise desktop 15
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP1
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP2
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP3
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise desktop 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise desktop 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise desktop 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise sap 15
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP1
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP2
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP3
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise sap 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise sap 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise sap 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise server 15
2.16.4-3.3.2
fixed
suse enterprise server 15 SP1
2.16.4-3.3.2
fixed
suse enterprise server 15 SP2
2.26.1-3.25.2
fixed
suse enterprise server 15 SP3
2.26.1-3.25.2
fixed
suse enterprise server 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise server 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise server 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise server 15 SP7
2.43.0-150600.3.9.1
fixed
git-core
suse enterprise sap 12 SP1
2.12.3-27.14.1
fixed
suse enterprise sap 12 SP2
2.12.3-27.14.1
fixed
suse enterprise server 12
2.12.3-27.14.1
fixed
suse enterprise server 12 SP1
2.12.3-27.14.1
fixed
suse enterprise server 12 SP2
2.12.3-27.14.1
fixed
git-cvs
suse enterprise desktop 15
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP1
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP2
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP3
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise desktop 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise desktop 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise desktop 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise sap 15
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP1
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP2
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP3
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise sap 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise sap 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise sap 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise server 15
2.16.4-3.3.2
fixed
suse enterprise server 15 SP1
2.16.4-3.3.2
fixed
suse enterprise server 15 SP2
2.26.1-3.25.2
fixed
suse enterprise server 15 SP3
2.26.1-3.25.2
fixed
suse enterprise server 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise server 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise server 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise server 15 SP7
2.43.0-150600.3.9.1
fixed
git-daemon
suse enterprise desktop 15
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP1
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP2
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP3
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise desktop 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise desktop 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise desktop 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise sap 15
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP1
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP2
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP3
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise sap 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise sap 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise sap 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise server 15
2.16.4-3.3.2
fixed
suse enterprise server 15 SP1
2.16.4-3.3.2
fixed
suse enterprise server 15 SP2
2.26.1-3.25.2
fixed
suse enterprise server 15 SP3
2.26.1-3.25.2
fixed
suse enterprise server 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise server 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise server 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise server 15 SP7
2.43.0-150600.3.9.1
fixed
git-doc
suse enterprise desktop 15
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP1
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP2
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP3
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise desktop 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise desktop 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise desktop 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise sap 12 SP1
2.12.3-27.14.1
fixed
suse enterprise sap 12 SP2
2.12.3-27.14.1
fixed
suse enterprise sap 15
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP1
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP2
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP3
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise sap 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise sap 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise sap 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise server 12
2.12.3-27.14.1
fixed
suse enterprise server 12 SP1
2.12.3-27.14.1
fixed
suse enterprise server 12 SP2
2.12.3-27.14.1
fixed
suse enterprise server 15
2.16.4-3.3.2
fixed
suse enterprise server 15 SP1
2.16.4-3.3.2
fixed
suse enterprise server 15 SP2
2.26.1-3.25.2
fixed
suse enterprise server 15 SP3
2.26.1-3.25.2
fixed
suse enterprise server 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise server 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise server 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise server 15 SP7
2.43.0-150600.3.9.1
fixed
git-email
suse enterprise desktop 15
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP1
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP2
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP3
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise desktop 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise desktop 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise desktop 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise sap 15
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP1
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP2
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP3
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise sap 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise sap 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise sap 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise server 15
2.16.4-3.3.2
fixed
suse enterprise server 15 SP1
2.16.4-3.3.2
fixed
suse enterprise server 15 SP2
2.26.1-3.25.2
fixed
suse enterprise server 15 SP3
2.26.1-3.25.2
fixed
suse enterprise server 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise server 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise server 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise server 15 SP7
2.43.0-150600.3.9.1
fixed
git-gui
suse enterprise desktop 15
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP1
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP2
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP3
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise desktop 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise desktop 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise desktop 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise sap 15
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP1
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP2
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP3
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise sap 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise sap 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise sap 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise server 15
2.16.4-3.3.2
fixed
suse enterprise server 15 SP1
2.16.4-3.3.2
fixed
suse enterprise server 15 SP2
2.26.1-3.25.2
fixed
suse enterprise server 15 SP3
2.26.1-3.25.2
fixed
suse enterprise server 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise server 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise server 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise server 15 SP7
2.43.0-150600.3.9.1
fixed
git-svn
suse enterprise desktop 15
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP1
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP2
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP3
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise desktop 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise desktop 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise desktop 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise sap 15
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP1
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP2
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP3
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise sap 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise sap 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise sap 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise server 15
2.16.4-3.3.2
fixed
suse enterprise server 15 SP1
2.16.4-3.3.2
fixed
suse enterprise server 15 SP2
2.26.1-3.25.2
fixed
suse enterprise server 15 SP3
2.26.1-3.25.2
fixed
suse enterprise server 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise server 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise server 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise server 15 SP7
2.43.0-150600.3.9.1
fixed
git-web
suse enterprise desktop 15
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP1
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP2
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP3
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise desktop 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise desktop 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise desktop 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise sap 15
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP1
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP2
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP3
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise sap 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise sap 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise sap 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise server 15
2.16.4-3.3.2
fixed
suse enterprise server 15 SP1
2.16.4-3.3.2
fixed
suse enterprise server 15 SP2
2.26.1-3.25.2
fixed
suse enterprise server 15 SP3
2.26.1-3.25.2
fixed
suse enterprise server 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise server 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise server 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise server 15 SP7
2.43.0-150600.3.9.1
fixed
gitk
suse enterprise desktop 15
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP1
2.16.4-3.3.2
fixed
suse enterprise desktop 15 SP2
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP3
2.26.1-3.25.2
fixed
suse enterprise desktop 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise desktop 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise desktop 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise desktop 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise sap 15
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP1
2.16.4-3.3.2
fixed
suse enterprise sap 15 SP2
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP3
2.26.1-3.25.2
fixed
suse enterprise sap 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise sap 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise sap 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise sap 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise server 15
2.16.4-3.3.2
fixed
suse enterprise server 15 SP1
2.16.4-3.3.2
fixed
suse enterprise server 15 SP2
2.26.1-3.25.2
fixed
suse enterprise server 15 SP3
2.26.1-3.25.2
fixed
suse enterprise server 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise server 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise server 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise server 15 SP7
2.43.0-150600.3.9.1
fixed
perl-Git
suse enterprise desktop 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise desktop 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise desktop 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise desktop 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise sap 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise sap 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise sap 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise sap 15 SP7
2.43.0-150600.3.9.1
fixed
suse enterprise server 15 SP4
2.35.3-150300.10.12.1
fixed
suse enterprise server 15 SP5
2.35.3-150300.10.27.1
fixed
suse enterprise server 15 SP6
2.43.0-150600.1.10
fixed
suse enterprise server 15 SP7
2.43.0-150600.3.9.1
fixed
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
http://www.securityfocus.com/bid/104346
http://www.securitytracker.com/id/1040991
https://access.redhat.com/errata/RHSA-2018:2147
https://marc.info/?l=git&m=152761328506724&w=2
https://security.gentoo.org/glsa/201805-13
https://usn.ubuntu.com/3671-1/
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
http://www.securityfocus.com/bid/104346
http://www.securitytracker.com/id/1040991
https://access.redhat.com/errata/RHSA-2018:2147
https://marc.info/?l=git&m=152761328506724&w=2
https://security.gentoo.org/glsa/201805-13
https://usn.ubuntu.com/3671-1/