The version of Atlassian SourceTree installed on the remote host is a version 0.5.1.0 prior to 2.6.9 . It is, therefore, affected by multiple vulnerabilities.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for libgit2 fixes the following issues :

  - CVE-2018-8099: Fixed possible denial of service attack     via different vectors by not being able to differentiate     between these status codes (bsc#1085256).

  - CVE-2018-11235: With a crafted .gitmodules file, a     malicious project can execute an arbitrary script on a     machine that runs 'git clone --recurse-submodules'     because submodule 'names' are obtained from this file,     and then appended to $GIT_DIR/modules, leading to     directory traversal with '../' in a name. Finally,     post-checkout hooks from a submodule are executed,     bypassing the intended design in which hooks are not     obtained from a remote server. (bsc#1095219)

  - CVE-2018-10887: It has been discovered that an     unexpected sign extension in git_delta_apply function in     delta.c file may have lead to an integer overflow which     in turn leads to an out of bound read, allowing to read     before the base object. An attacker could have used this     flaw to leak memory addresses or cause a Denial of     Service. (bsc#1100613)

  - CVE-2018-10888: A missing check in git_delta_apply     function in delta.c file, may lead to an out-of-bound     read while reading a binary delta file. An attacker may     use this flaw to cause a Denial of Service.
    (bsc#1100612)

  - CVE-2018-15501: A remote attacker can send a crafted     smart-protocol 'ng' packet that lacks a '\0' byte to     trigger an out-of-bounds read that leads to DoS.
    (bsc#1104641)

This update was imported from the SUSE:SLE-12-SP2:Update update project.

This update for git to version 2.16.4 fixes several issues. These security issues were fixed :

  - CVE-2018-11233: Path sanity-checks on NTFS allowed     attackers to read arbitrary memory (bsc#1095218)

  - CVE-2018-11235: Arbitrary code execution when     recursively cloning a malicious repository (bsc#1095219)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update of the git package has been released.

This update for fixes the following security issues :

  - path sanity-checks on NTFS can read arbitrary memory     (CVE-2018-11233, boo#1095218)

  - arbitrary code execution when recursively cloning a     malicious repository (CVE-2018-11235, boo#1095219)

This update for libgit2 to version 0.26.5 fixes the following issues :

The following security vulnerabilities were addressed :

  - CVE-2018-10887: Fixed an integer overflow which in turn     leads to an out of bound read, allowing to read the base     object, which could be exploited by an attacker to cause     denial of service (DoS) (bsc#1100613).

  - CVE-2018-10888: Fixed an out-of-bound read while reading     a binary delta file, which could be exploited by an     attacker t ocause a denial of service (DoS)     (bsc#1100612).

  - CVE-2018-11235: Fixed a remote code execution, which     could occur with a crafted .gitmodules file     (bsc#1095219)

  - CVE-2018-15501: Prevent out-of-bounds reads when     processing smart-protocol 'ng' packets (bsc#1104641)

This update was imported from the SUSE:SLE-15:Update update project.

The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3186:02 advisory.

    * git: arbitrary code execution when recursively cloning a malicious repository (CVE-2018-11235)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
117406	Atlassian SourceTree 0.5.1.0 < 2.6.9 Remote Code Execution Vulnerabilities	Nessus	Windows	2018/9/11	2023/10/24	critical
118486	openSUSE Security Update : libgit2 (openSUSE-2018-1314)	Nessus	SuSE Local Security Checks	2018/10/29	2024/7/26	high
120026	SUSE SLED15 / SLES15 Security Update : git (SUSE-SU-2018:1872-1)	Nessus	SuSE Local Security Checks	2019/1/2	2024/7/11	high
121844	Photon OS 1.0: Git PHSA-2018-1.0-0145	Nessus	PhotonOS Local Security Checks	2019/2/7	2019/4/2	high
123178	openSUSE Security Update : git (openSUSE-2019-410)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/12	high
123276	openSUSE Security Update : libgit2 (openSUSE-2019-638)	Nessus	SuSE Local Security Checks	2019/3/27	2024/6/11	high
289434	MiracleLinux 7 : git-1.8.3.1-14.el7 (AXSA:2018-3186:02)	Nessus	Miracle Linux Local Security Checks	2026/1/16	2026/1/16	high

检测

插件搜索

critical

high

high

high

high

high

high