Skip to content
OpenAdvisories
High · 8.6 CVE-2024-24577 EUVD-2024-21982

libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`

Published Feb 6, 2024 · Updated May 15, 2025 · Assigned by GitHub_M

Vendor: libgit2 Product: libgit2 Package: eza Package: libgit2 Package: libgit2 Package: libgit2 Package: libgit2 Package: libgit2 Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using well-crafted inputs to `git_index_add` can cause heap corruption that could be leveraged for arbitrary code execution. There is an issue in the `has_dir_name` function in `src/libgit2/index.c`, which frees an entry that should not be freed. The freed entry is later used and overwritten with potentially bad actor-controlled data leading to controlled heap corruption. Depending on the application that uses libgit2, this could lead to arbitrary code execution. This issue has been patched in version 1.6.5 and 1.7.2.

Affected products

VendorProductAffectedFixed
libgit2 libgit2 < 1.6.5, >= 1.7.0, < 1.7.2 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libgit2 1.7.2+ds-1 —
Debian 13 libgit2 1.7.2+ds-1 —
Debian 12 libgit2 1.5.1+ds-1+deb12u1 DSA-5619-1
Debian 11 libgit2 1.1.0+dfsg.1-4+deb11u2 DSA-5619-1
Debian 10 libgit2 0.27.7+dfsg.1-0.2+deb10u2 DLA-3742-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS libgit2 1.1.0+dfsg.1-4.1ubuntu0.1 USN-6678-1
Ubuntu 20.04 LTS libgit2 0.28.4+dfsg.1-2ubuntu0.1 USN-6678-1
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS libgit2 0.26.0+dfsg.1-1.1ubuntu0.2+esm1 USN-6678-1
Ubuntu Pro 16.04 LTS libgit2 0.24.1-2ubuntu0.2+esm2 USN-6678-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 git 2.43.0-150600.3.6.1 SUSE-SU-2024:2579-1
SLES 15 SP6 libgit2 1.7.2-150600.3.3.1 SUSE-SU-2024:2584-1
SLES 15 SP5 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
SLES 15 SP5 libgit2 1.3.0-150400.3.9.1 SUSE-SU-2024:2619-1
SLES 15 SP4 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
SLES 15 SP4 libgit2 1.3.0-150400.3.9.1 SUSE-SU-2024:2619-1
SLES 15 SP3 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
SLES 15 SP3 libgit2 0.28.4-150200.3.9.1 SUSE-SU-2024:2610-1
SLES 15 SP2 git 2.26.2-150000.59.1 SUSE-SU-2024:2599-1
SLES 15 SP2 libgit2 0.26.8-150000.3.21.1 SUSE-SU-2024:2610-1, SUSE-SU-2024:2598-1
Show 14 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 12 SP5 git 2.26.2-27.75.1 SUSE-SU-2024:2592-1
SLES 12 SP5 libgit2 0.24.1-11.5.1 SUSE-SU-2024:2583-1
SLES for SAP 15 SP4 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
SLES for SAP 15 SP4 libgit2 1.3.0-150400.3.9.1 SUSE-SU-2024:2619-1
SLES for SAP 15 SP3 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
SLES for SAP 15 SP3 libgit2 0.28.4-150200.3.9.1 SUSE-SU-2024:2610-1
SLES for SAP 15 SP2 git 2.26.2-150000.59.1 SUSE-SU-2024:2599-1
SLES for SAP 15 SP2 libgit2 0.26.8-150000.3.21.1 SUSE-SU-2024:2610-1, SUSE-SU-2024:2598-1
SLES for SAP 12 SP5 git 2.26.2-27.75.1 SUSE-SU-2024:2592-1
SLE Micro 6.0 git 2.51.0-1.1 SUSE-SU-2025:20721-1
SLE Micro 5.5 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
SLE HPC 15 SP4 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
SLE HPC 15 SP4 libgit2 1.3.0-150400.3.9.1 SUSE-SU-2024:2619-1
SLE HPC 15 SP3 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
SLE HPC 15 SP3 libgit2 0.28.4-150200.3.9.1 SUSE-SU-2024:2610-1
SLE HPC 15 SP2 git 2.26.2-150000.59.1 SUSE-SU-2024:2599-1
SLE HPC 15 SP2 libgit2 0.26.8-150000.3.21.1 SUSE-SU-2024:2610-1, SUSE-SU-2024:2598-1
SUSE Manager Server Module 4.3 libgit2 0.28.4-150200.3.9.1 SUSE-SU-2024:2610-1
SUSE Manager Server 4.3 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
SUSE Manager Proxy 4.3 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
SUSE Enterprise Storage 7.1 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
SUSE Enterprise Storage 7.1 libgit2 0.28.4-150200.3.9.1 SUSE-SU-2024:2610-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed git 2.45.2-2.1 openSUSE-SU-2024:14212-1
openSUSE Tumbleweed libgit2 1.7.2-1.1 openSUSE-SU-2024:13661-1
openSUSE Leap 15.6 git 2.43.0-150600.3.6.1 SUSE-SU-2024:2579-1
openSUSE Leap 15.6 libgit2 1.7.2-150600.3.3.1 SUSE-SU-2024:2584-1
openSUSE Leap 15.5 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1
openSUSE Leap 15.5 libgit2 1.3.0-150400.3.9.1 SUSE-SU-2024:2619-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.5 git 2.35.3-150300.10.42.1 SUSE-SU-2024:2656-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 eza 0.18.2-r0 —
Alpine v3.24 libgit2 1.7.2-r0 —
Alpine v3.23 eza 0.18.2-r0 —
Alpine v3.23 libgit2 1.7.2-r0 —
Alpine v3.22 eza 0.18.2-r0 —
Alpine v3.22 libgit2 1.7.2-r0 —
Alpine v3.21 eza 0.18.2-r0 —
Alpine v3.21 libgit2 1.7.2-r0 —
Alpine v3.20 eza 0.18.2-r0 —
Alpine v3.20 libgit2 1.7.2-r0 —
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 libgit2 1.7.2-r0 —

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 libgit2 +1 1.6.4-115.amzn2023.0.2 ALAS2023-2024-541
Amazon Linux 2023 rust +13 1.68.2-1.amzn2023.0.5 ALAS2023-2024-566
Amazon Linux 2 rust +11 1.68.2-1.amzn2.0.6 ALAS2-2024-2496

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 2 (CBL-Mariner) libgit2 1.6.5-1 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling libgit2 1.7.2-r0 —

Advisories 19

References