CVE-2012-4465

cgit < 0.9.0.3 - Authenticated Heap-Based Buffer Overflow via Empty Author Username

Title source: llm
STIX 2.1

Description

Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit.

References (7)

Core 7
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/09/30/1
Various Sources mailing-list x_refsource_mlist
http://hjemli.net/pipermail/cgit/2012-July/000652.html
Issue Tracking x_refsource_misc
https://bugzilla.redhat.com/show_bug.cgi?id=820733
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/50734
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/55724
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2012/10/03/7

Scores

EPSS 0.0338
EPSS Percentile 87.4%

Details

CWE
CWE-119
Status published
Products (28)
lars_hjemli/cgit 0.1
lars_hjemli/cgit 0.2
lars_hjemli/cgit 0.3
lars_hjemli/cgit 0.4
lars_hjemli/cgit 0.5
lars_hjemli/cgit 0.6
lars_hjemli/cgit 0.6.1
lars_hjemli/cgit 0.6.2
lars_hjemli/cgit 0.6.3
lars_hjemli/cgit 0.7
... and 18 more
Published Oct 10, 2012
Tracked Since Feb 18, 2026