Libgit2
Vendor:
First CVE: Feb 3, 2017 · Active for 9 years
16
Total CVEs
More Total CVEs than 77% of tracked products
3.2
Avg CVEs / Year
Higher CVE frequency than 87% of tracked products
7.6
Avg CVSS
Higher Avg CVSS than 39% of tracked products
0.0%
KEV Rate
Bottom 1%
Trends Over Time
The number and severity of CVEs published that impact Libgit2 over time
Volume of CVEsAvg CVSS Base Score
First CVE
Feb 3, 2017
9 years ago
Most Recent CVE
Feb 6, 2024
899 days ago
CVE Severity & Scoring
Libgit216 CVEs
44%
25%
31%
All CVEs352,231 CVEs
45%
40%
11%
MediumHighCritical
Attack Vector
Local2 (12.5%)
Network14 (87.5%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low14 (87.5%)
High2 (12.5%)
Unknown0 (0.0%)
User Interaction
None10 (62.5%)
Unknown0 (0.0%)
Required6 (37.5%)
Privileges Required
Low0 (0.0%)
High0 (0.0%)
None16 (100.0%)
Unknown0 (0.0%)
Top CVEs
Signals from CVEs in this product scope (16 CVEs).
16 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-9390CRITICAL Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode | Feb 12, 2020 | 9.8 | 76 | NO | YES |
CVE-2020-12279CRITICAL An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. checkout.c mishandles equivalent filenames that exist because of NTFS short names. This may allow remote co | Apr 27, 2020 | 9.8 | 32 | NO | NO |
CVE-2016-10128CRITICAL Buffer overflow in the git_pkt_parse_line function in transports/smart_pkt.c in the Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attac | Mar 24, 2017 | 9.8 | 31 | NO | NO |
CVE-2024-24577CRITICAL libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using wel | Feb 6, 2024 | 9.8 | 28 | NO | NO |
CVE-2020-12278CRITICAL An issue was discovered in libgit2 before 0.28.4 and 0.9x before 0.99.0. path.c mishandles equivalent filenames that exist because of NTFS Alternate Data Streams. This may allow re | Apr 27, 2020 | 9.8 | 27 | NO | NO |
CVE-2018-15501HIGH In ng_pkt in transports/smart_pkt.c in libgit2 before 0.26.6 and 0.27.x before 0.27.4, a remote attacker can send a crafted smart-protocol "ng" packet that lacks a '\0' byte to tri | Aug 18, 2018 | 7.5 | 27 | NO | NO |
CVE-2018-10887HIGH A flaw was found in libgit2 before version 0.27.3. It has been discovered that an unexpected sign extension in git_delta_apply function in delta.c file may lead to an integer overf | Jul 10, 2018 | 8.1 | 25 | NO | NO |
CVE-2016-10129HIGH The Git Smart Protocol support in libgit2 before 0.24.6 and 0.25.x before 0.25.1 allows remote attackers to cause a denial of service (NULL pointer dereference) via an empty packet | Mar 24, 2017 | 7.5 | 25 | NO | NO |
CVE-2018-8099MEDIUM Incorrect returning of an error code in the index.c:read_entry() function leads to a double free in libgit2 before v0.26.2, which allows an attacker to cause a denial of service vi | Mar 14, 2018 | 6.5 | 23 | NO | NO |
CVE-2024-24575HIGH libgit2 is a portable C implementation of the Git core methods provided as a linkable library with a solid API, allowing to build Git functionality into your application. Using wel | Feb 6, 2024 | 7.5 | 22 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (16 CVEs).
CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
1 CVE
6.2% of CVEs· Bottom 1%
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%
Social Chatter
Signals from CVEs in this product scope (16 CVEs).
Media Mentions
Signals from CVEs in this product scope (16 CVEs).
Top CNAs Publishing CVEs For Libgit2
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 1.5.0 | 1 | 5.9 | 0.6% | 0 | 0 |
| 0.25.0 | 3 | 7.7 | 3.1% | 0 | 0 |