CVE-2015-0838
Dulwich Buffer Overflow when handling pack files
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
Exploit likelihood
What each source reports
NVD Score used
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
- Record
CVE-2015-0838- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
- Record
CVE-2015-0838- Updated
- 2026-11-02
EUVDEUVD-2015-0020 No score
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
- Record
EUVD-2015-0020- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-vjjf-3rvg-gv3v
Dulwich Buffer Overflow when handling pack files
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
- Record
GHSA-vjjf-3rvg-gv3v- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVGHSA-vjjf-3rvg-gv3v
Dulwich Buffer Overflow when handling pack files
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
- Record
GHSA-vjjf-3rvg-gv3v- CVSS 4.0
- 9.3 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 9.8 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSV No score
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
- Record
CVE-2015-0838- Updated
- 2026-11-02
Show 7 moreShow less
OSVDEBIAN-CVE-2015-0838 No score
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
- Record
DEBIAN-CVE-2015-0838- Updated
- 2026-11-02
OSVMGASA-2015-0157 No score
Updated python-dulwich packages fix security vulnerabilities
Updated python-dulwich package fixes security vulnerabilities:
It was discovered that Dulwich allows writing to files under .git/ when checking out working trees. This could lead to the execution of arbitrary code with the privileges of the user running an application based on Dulwich (CVE-2014-9706).
Ivan Fratric of the Google Security Team has found a buffer overflow in the C implementation of the apply_delta() function, used when accessing Git objects in pack files. An attacker could take advantage of this flaw to cause the execution of arbitrary code with the privileges of the user running a Git server or client based on Dulwich (CVE-2015-0838).
The python-dulwich package has been updated to version 0.10.0, fixing these issues and other bugs.
- Record
MGASA-2015-0157- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10124-1 No score
python-dulwich-0.12.0-2.3 on GA media
These are all security issues fixed in the python-dulwich-0.12.0-2.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10124-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11228-1 No score
python36-dulwich-0.20.24-1.3 on GA media
These are all security issues fixed in the python36-dulwich-0.20.24-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11228-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14139-1 No score
python310-dulwich-0.21.7-1.3 on GA media
These are all security issues fixed in the python310-dulwich-0.21.7-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14139-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:11190-1 No score
python313-dulwich-1.2.7-1.1 on GA media
These are all security issues fixed in the python313-dulwich-1.2.7-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:11190-1- Updated
- 2026-11-02
OSVPYSEC-2015-35 No score
Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.
- Record
PYSEC-2015-35- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
dulwichPyPI |
before 0.9.9 | 0.9.9 |
dulwichDebian:12 |
before 0.10.1-1 | 0.10.1-1 |
dulwichDebian:13 |
before 0.10.1-1 | 0.10.1-1 |
dulwichDebian:14 |
before 0.10.1-1 | 0.10.1-1 |
dulwichDebian:6.0 |
before 0.6.1-1+deb6u1, plus listed versions 0.6.1-1 |
0.6.1-1+deb6u1 |
dulwichDebian:7 From an advisory covering 2 CVEs |
before 0.8.5-2+deb7u2, plus listed versions 0.8.5-20.8.5-2+deb7u1 |
0.8.5-2+deb7u2 |
dulwichPyPI |
before 0.9.9, plus listed versions 0.0.10.1.00.1.10.2.10.3.0 Show 28 moreShow less0.3.10.3.20.3.30.4.00.4.10.5.00.6.00.6.10.6.20.7.00.7.10.8.00.8.10.8.20.8.30.8.40.8.50.8.60.8.70.9.00.9.10.9.20.9.30.9.40.9.50.9.60.9.70.9.8 |
0.9.9 |
python-dulwichMageia:4 From an advisory covering 2 CVEs |
before 0.10.0-1.mga4 | 0.10.0-1.mga4 |
python-dulwichopenSUSE:Tumbleweed |
before 0.12.0-2.3 | 0.12.0-2.3 |
python-dulwichopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 0.21.7-1.3 | 0.21.7-1.3 |
python-dulwichopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.2.7-1.1 | 1.2.7-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-0838 is a high vulnerability (CVSS 7.5) in Dulwich Project Dulwich, published March 28, 2015. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.38%, the 88th percentile. Fixed in dulwich 0.9.9.