CVE-2008-3546

Git - Stack-Based Buffer Overflow in diff_addremove and diff_change Functions

Title source: llm
STIX 2.1

Description

Stack-based buffer overflow in the (1) diff_addremove and (2) diff_change functions in GIT before 1.5.6.4 might allow local users to execute arbitrary code via a PATH whose length is larger than the system's PATH_MAX when running GIT utilities such as git-diff or git-grep.

References (18)

Core 18
Core References
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/495391/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32029
Third Party Advisory x_refsource_confirm
http://wiki.rpath.com/Advisories:rPSA-2008-0253
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44217
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/33964
Issue Tracking x_refsource_confirm
https://issues.rpath.com/browse/RPL-2707
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31347
Third Party Advisory vendor-advisory x_refsource_gentoo
http://security.gentoo.org/glsa/glsa-200809-16.xml
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2008/dsa-1637
Exploit mailing-list x_refsource_mlist
http://kerneltrap.org/mailarchive/git/2008/7/16/2529284
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/32384
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/30549
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2008/2306
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id?1020627
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/31780
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-723-1

Scores

EPSS 0.0430
EPSS Percentile 90.0%

Details

CWE
CWE-119
Status published
Products (5)
git/git 1.5.5.3 (2 CPE variants)
git/git 1.5.5.4
git/git 1.5.6.1
git/git 1.5.6.2
git/git 1.5.6.3
Published Aug 07, 2008
Tracked Since Feb 18, 2026