CVE-2016-2315

41

FAUCET Score

CVE-2016-2315 is a critical heap-based buffer overflow vulnerability affecting Git versions prior to 2.7.4, as well as products like openSUSE and SUSE. This flaw, stemming from an incorrect integer data type in revision.c, allows remote attackers to execute arbitrary code through crafted long filenames or numerous nested trees. With a CVSS score of 9.8 (CRITICAL), it presents a severe risk due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While there is no known active exploitation or publicly available exploit code in Metasploit, Nuclei, or ExploitDB, the vulnerability has garnered significant community discussion and media coverage, indicating its perceived importance.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		11CPE matchmatch criteria	cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4::::::
		5CPE matchmatch criteria	cpe:2.3:a:suse:openstack_cloud:5:::::::*
		42.1CPE matchmatch criteria	cpe:2.3:o:opensuse:leap:42.1:::::::*
		13.2CPE matchmatch criteria	cpe:2.3:o:opensuse:opensuse:13.2:::::::*
		12CPE matchmatch criteria	cpe:2.3:o:suse:linux_enterprise_server:12:sp1::::::

CVSS Data

CVSS version used by this source: 3.1

9.8CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

3.9

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

17.98%

Probability of exploitation in next 30 days

EPSS Percentile

96.9%

Percentile rank of EPSS score among Peer Group

As of 2026-07-24

Model: v2026.06.15

This CVE's current EPSS score of 0.1798 is in the 93rd percentile among its peer group of 36,829 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (10)

github_advisorypatch availablevia nvd_reference

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 6Fixed in: git-0:1.7.1-4.el6_7.1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7Fixed in: git-0:1.8.3.1-6.el7_2.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6Fixed in: git19-git-0:1.9.4-4.el6.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.6 EUSFixed in: git19-git-0:1.9.4-4.el6.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 6.7 EUSFixed in: git19-git-0:1.9.4-4.el6.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7Fixed in: git19-git-0:1.9.4-4.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.1 EUSFixed in: git19-git-0:1.9.4-4.el7.1

redhatpatch availablevia redhat_api

Product: Red Hat Software Collections for Red Hat Enterprise Linux 7.2 EUSFixed in: git19-git-0:1.9.4-4.el7.1

susevendor investigatingvia nvd_reference

Vendor Advisories (1)

redhatCVE-2016-2315Important

git: path_name() integer truncation and overflow leading to buffer overflow

References

lists.fedoraproject.org / pipermail/package-announce/2016-April/183147.html

Mailing ListThird Party Advisory

lists.fedoraproject.org / pipermail/package-announce/2016-March/179121.html

Mailing ListThird Party Advisory

lists.fedoraproject.org / pipermail/package-announce/2016-March/180763.html

Mailing ListThird Party Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00059.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00060.html

Mailing List

lists.opensuse.org / opensuse-security-announce/2016-03/msg00061.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00062.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00071.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00074.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00076.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-security-announce/2016-03/msg00077.html

Mailing ListVendor Advisory

lists.opensuse.org / opensuse-updates/2016-04/msg00011.html

Mailing ListVendor Advisory

pastebin.com / UX2P2jjg

Third Party Advisory

rhn.redhat.com / errata/RHSA-2016-0496.html

Third Party Advisory

github.com / git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305

PatchThird Party Advisory

github.com / git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60

PatchThird Party Advisory

raw.githubusercontent.com / git/git/master/Documentation/RelNotes/2.7.4.txt

Vendor Advisory

security.gentoo.org / glsa/201605-01

Third Party Advisory

debian.org / security/2016/dsa-3521

Third Party Advisory

openwall.com / lists/oss-security/2016/03/15/5

Mailing List

oracle.com / technetwork/topics/security/bulletinapr2016-2952098.html

Third Party Advisory

oracle.com / technetwork/topics/security/linuxbulletinapr2016-2952096.html

Third Party Advisory

securityfocus.com / bid/84355

Third Party AdvisoryVDB Entry

securitytracker.com / id/1035290

Third Party AdvisoryVDB Entry

ubuntu.com / usn/USN-2938-1

Third Party Advisory