CVE-2012-4465
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows...
CVE-2012-4465 is a medium vulnerability (CVSS 6.5) in Lars Hjemli Cgit, published October 10, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.38%, the 88th percentile. No source names a fixed version.
- Severity
- 6.5 MediumCVSS 2.0, NVD
- Exploit chance
- 3.38%EPSS, 88th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
- No fix listedNo source names one
Description
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cgitopenSUSE:Tumbleweed From an advisory covering 9 CVEs | before 1.0-1.3 | 1.0-1.3 |
What each source reports
NVD Score used
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit.
- Record
CVE-2012-4465- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE ListNo score
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit.
- Record
CVE-2012-4465- Updated
- 2026-11-02
EUVDEUVD-2012-4394No score
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit.
- Record
EUVD-2012-4394- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-79m9-fj96-r8q8No score
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows...
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit.
- Record
GHSA-79m9-fj96-r8q8- Weakness
- CWE-119
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10137-1No score
cgit-1.0-1.3 on GA media
These are all security issues fixed in the cgit-1.0-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10137-1- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
openwall.com/lists/oss-security/2012/09/30/1
git.zx2c4.com/cgit/commit?id=7757d1b046ecb67b830151d20715c658867df1ec
hjemli.net/pipermail/cgit/2012-July/000652.html
bugzilla.redhat.com/show_bug.cgi?id=820733
secunia.com/advisories/50734
securityfocus.com/bid/55724
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2012-4465
github.com/advisories/GHSA-79m9-fj96-r8q8
suse.com/security/cve/CVE-2011-2711