CVE-2008-3546

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2008-08-07 · updated 2026-06-16
Weakness: CWE-119

Description

Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length is larger than the system's PATH_MAX when running GIT utilities such as git-diff or git-grep.

Affected products

Git: 1.5.5.3, 1.5.5.3-r1, 1.5.5.4, 1.5.6.1, 1.5.6.2, 1.5.6.3

References

http://kerneltrap.org/mailarchive/git/2008/7/16/2529284
http://secunia.com/advisories/31347
http://secunia.com/advisories/31780
http://secunia.com/advisories/32029
http://secunia.com/advisories/32384
http://secunia.com/advisories/33964
http://security.gentoo.org/glsa/glsa-200809-16.xml
http://wiki.rpath.com/Advisories:rPSA-2008-0253
http://www.debian.org/security/2008/dsa-1637
http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.5.6.4.txt
http://www.securityfocus.com/archive/1/495391/100/0/threaded
http://www.securityfocus.com/bid/30549

Get alerted when CVE-2008-3546 or the next vulnerability affects your stack