CVE-2018-11233

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 44%
VendorProductVersion
canonicalubuntu_linux
14.04
canonicalubuntu_linux
16.04
canonicalubuntu_linux
17.10
canonicalubuntu_linux
18.04
git-scmgit
𝑥
≤ 2.13.6
git-scmgit
2.14.0 ≤
𝑥
≤ 2.14.3
git-scmgit
2.15.0 ≤
𝑥
≤ 2.15.1
git-scmgit
2.16.0 ≤
𝑥
≤ 2.16.3
git-scmgit
2.17.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
git
bullseye
1:2.30.2-1+deb11u2
fixed
bullseye (security)
1:2.30.2-1+deb11u3
fixed
bookworm
1:2.39.2-1.1
fixed
bookworm (security)
1:2.39.5-0+deb12u1
fixed
trixie
1:2.45.2-1
fixed
sid
1:2.45.2-1.1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
git
bionic
Fixed 1:2.17.1-1ubuntu0.1
released
artful
Fixed 1:2.14.1-1ubuntu4.1
released
xenial
Fixed 1:2.7.4-0ubuntu1.4
released
trusty
Fixed 1:1.9.1-1ubuntu0.8
released
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
http://www.securityfocus.com/bid/104346
http://www.securitytracker.com/id/1040991
https://access.redhat.com/errata/RHSA-2018:2147
https://marc.info/?l=git&m=152761328506724&w=2
https://security.gentoo.org/glsa/201805-13
https://usn.ubuntu.com/3671-1/
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
http://www.securityfocus.com/bid/104346
http://www.securitytracker.com/id/1040991
https://access.redhat.com/errata/RHSA-2018:2147
https://marc.info/?l=git&m=152761328506724&w=2
https://security.gentoo.org/glsa/201805-13
https://usn.ubuntu.com/3671-1/