CVE-2018-10887

HighCVSS 8.1/10Last modified Jun 17, 2026

Description

A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H

Weakness enumeration

CWE-194CWE-125CWE-190CWE-681

Affected software

No affected versions have been published.

Timeline

Published
Jul 10, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-108886.5A flaw was found in libgit2 before version 0.27.3. A missing check in git_delta_apply function in delta.c file, may lead to an out-of-bound CVE-2018-108895.3A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7. No option existed to omit logs from data privacy exports, which may contain CVE-2018-10897.5389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possiblyCVE-2018-108905.3A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. It was possible for the core_course_get_categories web service to reCVE-2018-108917.3A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3.7, 3.1.13. When a quiz question bank is imported, it was possible for the questCVE-2018-108925.3The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw alloCVE-2018-108938.8Multiple integer overflow and buffer overflow issues were discovered in spice-client's handling of LZ compressed frames. A malicious server CVE-2018-108945.4It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use thiCVE-2018-108958.8qutebrowser before version 1.4.1 is vulnerable to a cross-site request forgery flaw that allows websites to access 'qute://*' URLs. A maliciCVE-2018-108967.1The default cloud-init configuration, in cloud-init 0.6.2 and newer, included "ssh_deletekeys: 0", disabling cloud-init's deletion of ssh hoCVE-2018-108978.1A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configurCVE-2018-108988.8A vulnerability was found in openstack-tripleo-heat-templates before version 8.0.2-40. When deployed using Director using default configurat
CVE-2018-10887: High severity, CVSS 8.1 | Vulnix