{"id":"CVE-2015-0838","aliases":["DEBIAN-CVE-2015-0838","DLA-231-1","DSA-3206-1","EUVD-2015-0020","GHSA-vjjf-3rvg-gv3v","MGASA-2015-0157","PYSEC-2015-35","openSUSE-SU-2024:10124-1","openSUSE-SU-2024:11228-1","openSUSE-SU-2024:14139-1","openSUSE-SU-2026:11190-1"],"status":"published","title":"Dulwich Buffer Overflow when handling pack files","description":"Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03379,"percentile":0.8885,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119"],"published":"2015-03-28T00:00:00Z","modified":"2026-09-09T06:47:23Z","fixes":[{"ecosystem":"PyPI","package":"dulwich","fixed_in":["0.9.9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"dulwich","fixed_in":["0.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"dulwich","fixed_in":["0.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"dulwich","fixed_in":["0.10.1-1"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"dulwich","fixed_in":["0.6.1-1+deb6u1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-dulwich","fixed_in":["0.12.0-2.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.1-1"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-1+deb6u1"}]}],"versions":["0.6.1-1"]},{"source":"osv","ecosystem":"Debian:7","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.5-2+deb7u2"}]}],"versions":["0.8.5-2","0.8.5-2+deb7u1"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9"}]}],"versions":["0.0.1","0.1.0","0.1.1","0.2.1","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.1","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8"]},{"source":"osv","ecosystem":"Mageia:4","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.10.0-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.9"}]}],"versions":["0.0.1","0.1.0","0.1.1","0.2.1","0.3.0","0.3.1","0.3.2","0.3.3","0.4.0","0.4.1","0.5.0","0.6.0","0.6.1","0.6.2","0.7.0","0.7.1","0.8.0","0.8.1","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.9.0","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.0-2.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.7-1.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-dulwich","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.7-1.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"dulwich_project","product":"dulwich"}],"references":[{"url":"http://www.debian.org/security/2015/dsa-3206","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://lists.launchpad.net/dulwich-users/msg00829.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-0838","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/dulwich/PYSEC-2015-35.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-vjjf-3rvg-gv3v","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-0838","tags":["advisory"]},{"url":"https://github.com/jelmer/dulwich","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2015-0157.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15558","tags":["report"]},{"url":"https://www.debian.org/security/2015/dsa-3206","tags":["web"]},{"url":"https://git.samba.org/?p=jelmer/dulwich.git;a=blob;f=NEWS;h=d0616a0c","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0838","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16228","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-0838","description":"Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.","status":"published","published":"2015-03-31T14:00:00Z","modified":"2024-08-06T04:26:11.072Z","updated_at":"2026-11-02T14:35:45.088047Z"}],"euvd":[{"id":"EUVD-2015-0020","description":"Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.","status":"published","published":"2015-03-31T14:00:00Z","modified":"2024-08-06T04:26:11Z","updated_at":"2026-11-03T02:22:18.008513Z"}],"ghsa":[{"id":"GHSA-vjjf-3rvg-gv3v","title":"Dulwich Buffer Overflow when handling pack files","description":"Buffer overflow in the C implementation of the `apply_delta` function `in _pack.c` in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.","status":"published","published":"2022-05-17T04:14:09Z","modified":"2024-09-20T17:39:38Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:38:04.690827Z"}],"nvd":[{"id":"CVE-2015-0838","description":"Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.","status":"published","published":"2015-03-31T14:59:08.173Z","modified":"2026-06-17T00:21:00.647Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:03:03.313464Z"}],"osv":[{"id":"GHSA-vjjf-3rvg-gv3v","title":"Dulwich Buffer Overflow when handling pack files","description":"Buffer overflow in the C implementation of the `apply_delta` function `in _pack.c` in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.","status":"published","published":"2022-05-17T04:14:09Z","modified":"2025-04-14T22:28:43.951717Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"},{"version":"4.0","score":9.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"critical"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T15:46:57.348035Z"},{"id":"CVE-2015-0838","description":"Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.","status":"published","published":"2015-03-31T14:59:08Z","modified":"2026-07-07T08:44:25.59709045Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-0838","description":"Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.","status":"published","published":"2015-03-31T14:59:08.173Z","modified":"2026-09-09T06:47:23.62177216Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"DLA-231-1","title":"dulwich - security update","status":"published","published":"2015-05-27T00:00:00Z","modified":"2026-03-09T01:23:15.823269Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-3206-1","title":"dulwich - security update","status":"published","published":"2015-03-28T00:00:00Z","modified":"2026-03-09T01:19:27.818968Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2015-0157","title":"Updated python-dulwich packages fix security vulnerabilities","description":"Updated python-dulwich package fixes security vulnerabilities:\n\nIt was discovered that Dulwich allows writing to files under .git/ when\nchecking out working trees. This could lead to the execution of arbitrary\ncode with the privileges of the user running an application based on Dulwich\n(CVE-2014-9706).\n\nIvan Fratric of the Google Security Team has found a buffer overflow in the\nC implementation of the apply_delta() function, used when accessing Git\nobjects in pack files. An attacker could take advantage of this flaw to\ncause the execution of arbitrary code with the privileges of the user\nrunning a Git server or client based on Dulwich (CVE-2015-0838).\n\nThe python-dulwich package has been updated to version 0.10.0, fixing these\nissues and other bugs.\n","status":"published","published":"2015-04-15T17:22:53Z","modified":"2026-04-16T06:25:31.799874309Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10124-1","title":"python-dulwich-0.12.0-2.3 on GA media","description":"These are all security issues fixed in the python-dulwich-0.12.0-2.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:05.728207Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:11228-1","title":"python36-dulwich-0.20.24-1.3 on GA media","description":"These are all security issues fixed in the python36-dulwich-0.20.24-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:21:12.385954Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:14139-1","title":"python310-dulwich-0.21.7-1.3 on GA media","description":"These are all security issues fixed in the python310-dulwich-0.21.7-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T02:20:08.348647Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2026:11190-1","title":"python313-dulwich-1.2.7-1.1 on GA media","description":"These are all security issues fixed in the python313-dulwich-1.2.7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-07-06T00:00:00Z","modified":"2026-07-07T08:30:07.572118855Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"PYSEC-2015-35","description":"Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.","status":"published","published":"2015-03-31T14:59:00Z","modified":"2026-06-10T17:01:12.353047752Z","updated_at":"2026-11-02T15:52:51.645172Z"}]}}