Skip to content
OpenAdvisories
Unscored USN-3671-1 2 CVEs

git vulnerabilities

Published Jun 5, 2018 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Etienne Stalmans discovered that git did not properly validate git
submodules files. A remote attacker could possibly use this to craft a
git repo that causes arbitrary code execution when "git clone
--recurse-submodules" is used. (CVE-2018-11235)

It was discovered that an integer overflow existed in git's pathname
consistency checking code when used on NTFS filesystems. An attacker could
use this to cause a denial of service or expose sensitive information.
(CVE-2018-11233)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS git 1:1.9.1-1ubuntu0.8
Ubuntu · 16.04 LTS 16.04:LTS git 1:2.7.4-0ubuntu1.4
Ubuntu · 18.04 LTS 18.04:LTS git 1:2.17.1-1ubuntu0.1

Vulnerabilities 2

  • Unscored —
    CVE-2018-11233

    In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, code …

    git git git Debian Ubuntu Alpine
  • Unscored —
    CVE-2018-11235 Public exploit EPSS 47%

    In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remot…

    git git git Debian Ubuntu Alpine

References

  • report
    https://ubuntu.com/security/CVE-2018-11233
  • report
    https://ubuntu.com/security/CVE-2018-11235