Description
Stack-based buffer overflow in the is_git_directory function in setup.c in Git before 1.7.2.1 allows local users to gain privileges via a long gitdir: field in a .git file in a working copy.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | git-core | 1:1.5.6.5-3+lenny3.1 | DSA-2114-1 |
Advisories 1
- DSA-2114-1 git-core Debian Security (DSA / DLA) · Mar 9, 2026
References
- 43457 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=618108
- [oss-security] 20100722 Re: CVE request: git mailing-list
- http://www.kernel.org/pub/software/scm/git/docs/RelNotes-1.7.2.1.txt
- SUSE-SR:2011:004 vendor-advisory
- [oss-security] 20100721 CVE request: git mailing-list
- ADV-2011-0464 vdb-entry
- 41891 vdb-entry
- http://git.kernel.org/?p=git/git.git%3Ba=commit%3Bh=3c9d0414ed2db0167e6c828b547be8fc9f88fccc