Most recent entries from all

bdu:2024-01377

BELL-CVE-2024-24577

Affected: Alpaquita:stream: libgit2

CLEANSTART-2024-DS47827 — libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowin…

Affected: CleanStart: eza

Security vulnerability affects the eza package. libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application.

EUVD-2026-239680

fkie_cve-2024-24577

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.

gsd-2024-24577

msrc_CVE-2024-24577 — libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`

msrc_CVE-2024-24577

OESA-2024-1188 — libgit2 security update

Affected: openEuler:20.03-LTS-SP1: libgit2, openEuler:20.03-LTS-SP4: libgit2, openEuler:22.03-LTS: libgit2, openEuler:22.03-LTS-SP1: libgit2, openEuler:22.03-LTS-SP2: libgit2, openEuler:22.03-LTS-SP3: libgit2

libgit2 is a portable, pure C implementation of the Git core methods provided as a re-entrant linkable library with a solid API, allowing you to write native speed custom Git applications in any language which supports C bindings. Security Fix(es): libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.(CVE-2024-24577)

openSUSE-SU-2024:13661-1 — libgit2-1_7-1.7.2-1.1 on GA media

libgit2-1_7-1.7.2-1.1 on GA media

RUSTSEC-2024-0013 — Memory corruption, denial of service, and arbitrary code execution in libgit2

Affected: crates.io: libgit2-sys

The [libgit2](https://github.com/libgit2/libgit2/) project fixed three security issues in the 1.7.2 release. These issues are:

* The `git_revparse_single` function can potentially enter an infinite loop on a well-crafted input, potentially causing a Denial of Service. This function is exposed in the `git2` crate via the [`Repository::revparse_single`](https://docs.rs/git2/latest/git2/struct.Repository.html#method.revparse_single) method. * The `git_index_add` function may cause heap corruption and possibly lead to arbitrary code execution. This function is exposed in the `git2` crate via the [`Index::add`](https://docs.rs/git2/latest/git2/struct.Index.html#method.add) method. * The smart transport negotiation may experience an out-of-bounds read when a remote server did not advertise capabilities.

The `libgit2-sys` crate bundles libgit2, or optionally links to a system libgit2 library. In either case, versions of the libgit2 library less than 1.7.2 are vulnerable. The 0.16.2 release of `libgit2-sys` bundles the fixed version of 1.7.2, and requires a system libgit2 version of at least 1.7.2.

It is recommended that all users upgrade.

SUSE-SU-2024:2579-1 — Security update for git

Security update for git

UBUNTU-CVE-2024-24577

Affected: Ubuntu:Pro:16.04:LTS: libgit2, Ubuntu:Pro:18.04:LTS: libgit2, Ubuntu:20.04:LTS: libgit2, Ubuntu:22.04:LTS: libgit2

WID-SEC-W-2025-0225 — Dell PowerProtect Data Domain: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Dell PowerProtect Data Domain ausnutzen, um erhöhte Rechte zu erlangen, einen Denial-of-Service-Zustand herbeizuführen und einen nicht näher spezifizierten Angriff durchzuführen.