CVE-2018-10887

A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overflow which in turn leads to an out of bound read, allowing to read before the base object. An attacker may use this flaw to leak memory addresses or cause a Denial of Service.

• CWE-194
• CWE-125
• CWE-190
• CWE-681

• https://bugzilla.redhat.com/show_bug.cgi?id=1598021Issue Tracking, Patch
• https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2aPatch
• https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22Patch
• https://github.com/libgit2/libgit2/releases/tag/v0.27.3Patch, Release Notes
• https://lists.debian.org/debian-lts-announce/2018/08/msg00024.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1598021Issue Tracking, Patch
• https://github.com/libgit2/libgit2/commit/3f461902dc1072acb8b7607ee65d0a0458ffac2aPatch
• https://github.com/libgit2/libgit2/commit/c1577110467b701dcbcf9439ac225ea851b47d22Patch
• https://github.com/libgit2/libgit2/releases/tag/v0.27.3Patch, Release Notes
• https://lists.debian.org/debian-lts-announce/2018/08/msg00024.htmlMailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/03/msg00031.htmlMailing List, Third Party Advisory

Published

Jul 10, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-10881A flaw was found in the Linux kernel's ext4 filesystem. A lo…4.2
• CVE-2018-10882A flaw was found in the Linux kernel's ext4 filesystem. A lo…4.8
• CVE-2018-10883A flaw was found in the Linux kernel's ext4 filesystem. A lo…4.8
• CVE-2018-10884Ansible Tower before versions 3.1.8 and 3.2.6 is vulnerable …8.8
• CVE-2018-10885In atomic-openshift before version 3.10.9 a malicious networ…6.5
• CVE-2018-10886Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-10888A flaw was found in libgit2 before version 0.27.3. A missing…6.5
• CVE-2018-10889A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3…4.3
• CVE-2018-1089389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did n…7.5
• CVE-2018-10890A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3…4.3
• CVE-2018-10891A flaw was found in moodle before versions 3.5.1, 3.4.4, 3.3…7.3
• CVE-2018-10892The default OCI linux spec in oci/defaults{_linux}.go in Doc…5.3