{"id":"CVE-2016-2315","details":"revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.","modified":"2026-08-07T14:49:20.663429Z","published":"2016-04-08T14:59:01.187Z","related":["SUSE-SU-2016:0796-1","SUSE-SU-2016:0798-1","openSUSE-SU-2024:10099-1","openSUSE-SU-2024:10137-1"],"database_specific":{"unresolved_ranges":[{"source":"CPE_STRING","vendor_product":"opensuse:leap","cpes":["cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"42.1"},{"last_affected":"42.1"}]},{"cpes":["cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"13.2"},{"last_affected":"13.2"}],"source":"CPE_STRING","vendor_product":"opensuse:opensuse"},{"cpes":["cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*"],"extracted_events":[{"introduced":"11-sp4"},{"last_affected":"11-sp4"}],"source":"CPE_STRING","vendor_product":"suse:linux_enterprise_debuginfo"},{"cpes":["cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12-sp1"},{"last_affected":"12-sp1"}],"source":"CPE_STRING","vendor_product":"suse:linux_enterprise_server"},{"extracted_events":[{"introduced":"11-sp4"},{"last_affected":"11-sp4"},{"introduced":"12"},{"last_affected":"12"},{"introduced":"12-sp1"},{"last_affected":"12-sp1"}],"source":"CPE_STRING","vendor_product":"suse:linux_enterprise_software_development_kit","cpes":["cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*","cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*","cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*"]},{"cpes":["cpe:2.3:a:suse:openstack_cloud:5:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"5"},{"last_affected":"5"}],"source":"CPE_STRING","vendor_product":"suse:openstack_cloud"},{"cpes":["cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"12"},{"last_affected":"12"}],"source":"CPE_STRING","vendor_product":"suse:suse_linux_enterprise_server"}]},"references":[{"type":"ADVISORY","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/183147.html"},{"type":"ADVISORY","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179121.html"},{"type":"ADVISORY","url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-March/180763.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00059.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00061.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00062.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00071.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00074.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00076.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00077.html"},{"type":"ADVISORY","url":"http://lists.opensuse.org/opensuse-updates/2016-04/msg00011.html"},{"type":"ADVISORY","url":"http://pastebin.com/UX2P2jjg"},{"type":"ADVISORY","url":"http://rhn.redhat.com/errata/RHSA-2016-0496.html"},{"type":"ADVISORY","url":"http://www.debian.org/security/2016/dsa-3521"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html"},{"type":"ADVISORY","url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html"},{"type":"ADVISORY","url":"http://www.securityfocus.com/bid/84355"},{"type":"ADVISORY","url":"http://www.securitytracker.com/id/1035290"},{"type":"ADVISORY","url":"http://www.ubuntu.com/usn/USN-2938-1"},{"type":"ADVISORY","url":"https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt"},{"type":"ADVISORY","url":"https://security.gentoo.org/glsa/201605-01"},{"type":"FIX","url":"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305"},{"type":"FIX","url":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60"},{"type":"ARTICLE","url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00060.html"},{"type":"ARTICLE","url":"http://www.openwall.com/lists/oss-security/2016/03/15/5"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/git-for-windows/git","events":[{"introduced":"594730e980521310d88006d91f3f14ef5eff1e2b"},{"last_affected":"594730e980521310d88006d91f3f14ef5eff1e2b"}],"database_specific":{"cpe":"cpe:2.3:a:git-scm:git:2.7.3:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.7.3"},{"last_affected":"2.7.3"}],"source":"CPE_STRING"}}],"versions":["2.7.3","v2.7.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2315.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/git/git","events":[{"introduced":"594730e980521310d88006d91f3f14ef5eff1e2b"},{"last_affected":"594730e980521310d88006d91f3f14ef5eff1e2b"},{"fixed":"34fa79a6cde56d6d428ab0d3160cb094ebad3305"},{"fixed":"de1e67d0703894cb6ea782e36abb63976ab07e60"}],"database_specific":{"cpe":"cpe:2.3:a:git-scm:git:2.7.3:*:*:*:*:*:*:*","extracted_events":[{"introduced":"2.7.3"},{"last_affected":"2.7.3"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["2.7.3","v2.7.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2315.json","vanir_signatures_modified":"2026-08-07T14:49:20Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305","target":{"file":"fast-import.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["333696384022721386841054920728184909299","48045774154125439734741568040160695019","225069583955810248539134064612039576001","285220004273926721586991470031090570975","207318146699266144512094565345281883568"]},"id":"CVE-2016-2315-104d7df7"},{"signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"pack-bitmap-write.c","function":"show_object"},"deprecated":false,"digest":{"function_hash":"86482523941693708903676221769142763047","length":194},"id":"CVE-2016-2315-1247ab52","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["4861392550014185053604563852680945285","70962342814146424007929177207417795489","291171301295482241896546329572056552471","155317780308335216064423533236627233294","110532300535431692778318665760980068499"],"threshold":0.9},"id":"CVE-2016-2315-17d8ea95","signature_type":"Line","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"pack-bitmap-write.c"}},{"target":{"file":"builtin/rev-list.c","function":"show_object"},"deprecated":false,"digest":{"function_hash":"288100378935089578568872503519465894223","length":256},"id":"CVE-2016-2315-1ccb9230","signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60"},{"deprecated":false,"digest":{"function_hash":"325276393784549001474003151192552946865","length":114},"id":"CVE-2016-2315-223330fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"reachable.c","function":"mark_commit"}},{"digest":{"line_hashes":["70146829142773461071083184690264298982","197941069194735395928613667619132616266","209598121663717537000091369334802967422","220928915496619309823160263219967322391","75036903129962617877548747904255012856","88737337735187253093497808307623838280","113250685843459321534646254318880294506","162544930704649277490857850115035881973","329995704242119950506577551202154421668","279132520445407823173993872318714776094","312084085530689627715700014881167618858","305972687634275646802003503163880705681","282450779027242777542431974782687640695","87188921987300370993024484420489906897","322099123069337422844577328723106297636","5652169802873483528295943907971399684","101560160953240182835852504860489714617","167332710564992570932490313913530081685","260446277523963954737593493431264704185","283737627443877978151133376657294922014","68072624707116902550857964656813011327"],"threshold":0.9},"id":"CVE-2016-2315-28349444","signature_type":"Line","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"list-objects.c"},"deprecated":false},{"target":{"file":"compat/nedmalloc/nedmalloc.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["141178588774867319040090048977069292037","95532322247239894981861591365896323583","288856492087438769885661556446629222083","8710360185724797378563528510987892988","45258962787700173668943380827187834032"]},"id":"CVE-2016-2315-3be6b8a7","signature_type":"Line","signature_version":"v1","source":"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"builtin/pack-objects.c","function":"record_recent_object"},"deprecated":false,"digest":{"function_hash":"53466673344511141317774105805771201567","length":151},"id":"CVE-2016-2315-434ee945"},{"target":{"file":"revision.c","function":"path_name"},"deprecated":false,"digest":{"length":547,"function_hash":"90785213450656997579291134798700043590"},"id":"CVE-2016-2315-44721628","signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305"},{"digest":{"line_hashes":["249856302936842626318914084041505844981","39174862031684243678188043275559375541","331525110735146200939747754612845057235","10548614524708121848964223171591020776","159068503624613744659940280948738645606","305670468495556257678522520241990989874","247119326134630192571145320118233244993","186349392561089366486677648502622554758","240348107366842886033523584498256256747","316159076634938068384449309867972129846","232894955276676214547268895912686386333","141899374053831151990835062582966102817","189129866211932039055110424876844453046","117882580120918280172602107579257703508","77106939909077844666167147527745139194","44795547006358352217719954856113614284","203280564292980155009306062044403057553","210599027959183772221776771278493465507"],"threshold":0.9},"id":"CVE-2016-2315-506da011","signature_type":"Line","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"builtin/rev-list.c"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"187697293590959492104858751944841702826","length":311},"id":"CVE-2016-2315-54158c97","signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"function":"show_object","file":"pack-bitmap.c"}},{"signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"list-objects.c","function":"process_tree"},"deprecated":false,"digest":{"function_hash":"245144354952552099008508166681611774293","length":1451},"id":"CVE-2016-2315-54fd7e22","signature_type":"Function"},{"target":{"file":"pack-bitmap.c","function":"test_show_object"},"deprecated":false,"digest":{"function_hash":"157515225737762462359487993761685263606","length":337},"id":"CVE-2016-2315-5527d2d1","signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"revision.c","function":"show_object_with_name"},"deprecated":false,"digest":{"function_hash":"160517248653732788859743432505621856451","length":334},"id":"CVE-2016-2315-5736ed1f"},{"id":"CVE-2016-2315-5d591bcc","signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305","target":{"function":"pool_strdup","file":"fast-import.c"},"deprecated":false,"digest":{"function_hash":"52745623141942765136416085359571578296","length":143}},{"deprecated":false,"digest":{"line_hashes":["275218773086729375644981622952840841685","193575302911872523203612980083630274917","313237292679823937595656788072742461461","46518507861909767560913623238940478362","136548397855281478077355250242186649402","141662122499968825612028615981259949220","24498835406793561324898905596661583652","142898919047819576724395848902992196772","338730436133783752892539815060552676138","93541518082144254057521754034544366475","196893218462005064950343087778411323437"],"threshold":0.9},"id":"CVE-2016-2315-63dfcb1d","signature_type":"Line","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"reachable.c"}},{"signature_version":"v1","source":"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305","target":{"file":"compat/nedmalloc/nedmalloc.c","function":"strdup"},"deprecated":false,"digest":{"function_hash":"28695504977565324158305268753340780301","length":163},"id":"CVE-2016-2315-6f86d49b","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"builtin/pack-objects.c"},"deprecated":false,"digest":{"line_hashes":["277559095732014147899979516063770844628","279216415017285681121021901733579582966","125899750344678807507888977071787488520","62503580664546593996462493112431949747","240447924283610858212379569458817269465","66214503303098087824130137842198064556","308986824005070133695625392757645906182","125586708992025507710545370618713685152","261083069297851441849167855530966814562","118414560719103236254734951107732139093","275108665365488455919298175294499305914","91241956107740548016298853992640323776","71872543195215365961378425131263738234","132152680582038276688340065029033138421","259685253482397727148416909498719376971","218389677462078546917960733919803725543","140380081156221265791181677598260635898"],"threshold":0.9},"id":"CVE-2016-2315-732759ff","signature_type":"Line"},{"id":"CVE-2016-2315-7b0d20c8","signature_type":"Line","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"pack-bitmap.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["146535793819305778961375495019688816366","205672480898859299408150138780552136061","291171301295482241896546329572056552471","155317780308335216064423533236627233294","259774265004757002944831019218016176128","216014742029212482385335902440690688103","300457814905650515345358903708415317089","18168926194714079319082551696273614668","308407019117561664042698432980286106209","88606093332803866741795946558645339092","316559818927618815086202062923840392872","106486677798633845689997844412377741769","107179240230231382498858622873421694616","280920206130819783023327134345603569966","256737910877295365452787387450081266782","244551193698795247881847261280379902977","330339925368253886083364116287040152495","40045458917575994719170197298955554881","179097797924127511851795390098180291780","195188943391020056715839829642527654433"]}},{"signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"builtin/rev-list.c","function":"finish_object"},"deprecated":false,"digest":{"function_hash":"56319272009654295954007311331073046398","length":381},"id":"CVE-2016-2315-7e76ded0","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"revision.h"},"deprecated":false,"digest":{"line_hashes":["175056807500528991003522803010929412528","338161945587528710931317714313259911219","81124370518328647219091633614093670588","208046837998431528875490097729748288758","200950013013403353091262057140930788295"],"threshold":0.9},"id":"CVE-2016-2315-844e132e","signature_type":"Line"},{"deprecated":false,"digest":{"line_hashes":["200909177789076378918771494602986366026","17502391705685587596211798716811567820","338025126927940698139090710584109332144","107858591837998904514550257371891333612"],"threshold":0.9},"id":"CVE-2016-2315-84bab2a5","signature_type":"Line","signature_version":"v1","source":"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305","target":{"file":"revision.c"}},{"deprecated":false,"digest":{"function_hash":"326389011656334400671345592685210038757","length":192},"id":"CVE-2016-2315-857d37c9","signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"revision.c","function":"path_name"}},{"target":{"file":"list-objects.h"},"deprecated":false,"digest":{"line_hashes":["35573754703524822671708683005965600543","234912277190636788353193295952080496077","220157560850149040600208475093267633837"],"threshold":0.9},"id":"CVE-2016-2315-8afe8fc9","signature_type":"Line","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60"},{"deprecated":false,"digest":{"function_hash":"80225387458769061186332595891932087333","length":284},"id":"CVE-2016-2315-9e8fefb4","signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"builtin/pack-objects.c","function":"show_object"}},{"source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"reachable.c","function":"mark_object"},"deprecated":false,"digest":{"function_hash":"106821476246760459903046627195560656903","length":118},"id":"CVE-2016-2315-b52234b5","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["337271610863593087407638918388099427595","118363189014156960488481375965879841342","87534414695767879060696618391674947105","7204169397971973833718050724195704878","55611564722385374036687493148962819740","12256048680325649679564300047997249596","249114233626335298680088929863227132338","329768033099069420426439324217971560061","318810277049775957529838462900930741118","139575627352914238136965541722465456795","139656467155831591819978433487407333607","171808909712024012766512768702965405892","209711564536397590789175815125724611029","97942055277792133426936528072992105973","84087103158123495491407966308344229275","9246513225771645764980028042420059001","103512517227806769335783325770163091189","196302295134245941110206571709473378781","222967266967215457466568908367144905851","250000479794030983925820738920806225808","79864454862862813355826357379257004130"],"threshold":0.9},"id":"CVE-2016-2315-bf7dd2d3","signature_type":"Line","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"revision.c"}},{"digest":{"function_hash":"279089347860008894253134245365687297669","length":1040},"id":"CVE-2016-2315-c18d9abf","signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"list-objects.c","function":"traverse_commit_list"},"deprecated":false},{"deprecated":false,"digest":{"length":372,"function_hash":"170388918960624928317685435593119763410"},"id":"CVE-2016-2315-d805a5ed","signature_type":"Function","signature_version":"v1","source":"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60","target":{"file":"list-objects.c","function":"process_blob"}}]}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}