libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.
Advisories
Source ID Title
Debian DLA Debian DLA DLA-3742-1 libgit2 security update
Debian DSA Debian DSA DSA-5619-1 libgit2 security update
EUVD EUVD EUVD-2024-21982 libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.
Ubuntu USN Ubuntu USN USN-6678-1 libgit2 vulnerabilities
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Thu, 15 May 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}


cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2025-05-15T19:43:35.897Z

Reserved: 2024-01-25T15:09:40.211Z

Link: CVE-2024-24577

cve-icon Vulnrichment

Updated: 2024-08-01T23:19:52.907Z

cve-icon NVD

Status : Modified

Published: 2024-02-06T22:16:15.270

Modified: 2024-11-21T08:59:27.603

Link: CVE-2024-24577

cve-icon Redhat

Severity : Important

Publid Date: 2024-02-06T00:00:00Z

Links: CVE-2024-24577 - Bugzilla

cve-icon OpenCVE Enrichment

No data.