CVE-2024-24577

libgit2

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2024-24577

Katalog CVE

CVSS 9.8 · Critical EPSS 1,5%

Kerentanan Heap-based Buffer Overflow pada libgit2. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.

Rincian

Terbit di NVD
6 Februari 2024
Terakhir diubah
17 Juni 2026
Status NVD
Modified
CVSS 3.1
9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-122: Heap-based Buffer Overflow
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
EPSS (30 hari)
1,5% peluang dieksploitasi; lebih tinggi dari 74,3% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
libgit2 libgit2 Semua versi sebelum 1.6.5
libgit2 libgit2 Versi 1.7.0 hingga sebelum 1.7.2

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.