SB2026081489 - Ubuntu update for libgit2
Published: August 14, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 10 vulnerabilities.
1) Buffer overflow (CVE-ID: CVE-2016-10128)
CWE-ID: CWE-119 - Memory corruption
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.
2) NULL pointer dereference (CVE-ID: CVE-2016-10129)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to a NULL pointer dereference error. A remote attacker can trigger denial of service conditions via an empty packet line.
3) Improper access control (CVE-ID: CVE-2016-10130)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote non-authenticated attacker to manipulate data.
The http_connect function in transports/http.c in libgit2 before 0.24.6 and 0.25.x before 0.25.1 might allow man-in-the-middle attackers to spoof servers by leveraging clobbering of the error variable.
4) Out-of-bounds read (CVE-ID: CVE-2018-15501)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to out-of-bounds read in ng_pkt in transports/smart_pkt.c in libgit2. A remote attacker can send a specially crafted smart-protocol "ng" packet that lacks a '' byte and cause the service to crash.
5) Out-of-bounds read (CVE-ID: CVE-2018-8098)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allow a remote attacker to cause DoS condition on the target system.
The weakness exists in the index.c:read_entry() function due to out-of-bounds read while decompressing a compressed prefix length. A remote attacker can send a specially crafted repository index file, trick the victim into opening it and cause the service to crash.
6) Double free (CVE-ID: CVE-2018-8099)
CWE-ID: CWE-415 - Double Free
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The weakness exists in the read_entry() function due to a double free error. A remote attacker can send a specially crafted repository index file, trick the victim into opening it and cause the service to crash.
7) Path traversal (CVE-ID: CVE-2026-53584)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to create directories outside the repository's working tree.
The vulnerability exists due to path traversal in submodule path handling when initializing a submodule in a crafted repository. A remote attacker can supply a crafted repository containing a submodule path with traversal components to create directories outside the repository's working tree.
User interaction is required to initialize a submodule in a crafted repository.
8) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-53585)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to allocation of resources without limits or throttling in git_delta_apply() when processing delta object headers in pack data. A remote attacker can supply a specially crafted pack file or malicious repository data to cause a denial of service.
The issue can be triggered through clone, fetch, indexer, or local repository pack processing, and multi-level OFS_DELTA chains can amplify memory consumption significantly.
9) Insufficiently protected credentials (CVE-ID: CVE-2026-53586)
CWE-ID: CWE-522 - Insufficiently Protected Credentials
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to insufficiently protected credentials in the builtin HTTP transport when following an offsite redirect for the initial smart HTTP request and handling a 401 authentication challenge from the redirected server. A remote attacker can cause an initial offsite redirect from a trusted Git remote URL to disclose sensitive information.
User interaction is required to contact a trusted original URL for which the application is willing to provide credentials.
10) Out-of-bounds read (CVE-ID: CVE-2026-53587)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to out-of-bounds read in set_data() in src/libgit2/transports/smart_pkt.c when parsing the first ref-pkt of a smart-protocol refs advertisement from a Git server. A remote attacker can send a specially crafted refs advertisement to cause a denial of service.
The issue is reachable before capability negotiation has taken place, and in some heap layouts the resulting error formatting may copy heap data into the error string.
Remediation
Install update from vendor's website.