CVE-2018-11233

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 4.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-05-30 · updated 2026-06-17
Weakness: CWE-125

Description

In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code to sanity-check pathnames on NTFS can result in reading out-of-bounds memory.

Affected products

Canonical Ubuntu Linux: 14.04, 16.04, 17.10, 18.04
git: through 2.13.6; from 2.14.0 through 2.14.3; from 2.15.0 through 2.15.1; from 2.16.0 through 2.16.3; 2.17.0

References

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
http://www.securityfocus.com/bid/104346
http://www.securitytracker.com/id/1040991
https://access.redhat.com/errata/RHSA-2018:2147
https://marc.info/?l=git&m=152761328506724&w=2
https://security.gentoo.org/glsa/201805-13
https://usn.ubuntu.com/3671-1/
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00003.html
http://www.securityfocus.com/bid/104346
http://www.securitytracker.com/id/1040991
https://access.redhat.com/errata/RHSA-2018:2147
https://marc.info/?l=git&m=152761328506724&w=2

Get alerted when CVE-2018-11233 or the next vulnerability affects your stack