{"id":"CVE-2024-25817","aliases":["GHSA-3qx3-6hxr-j2ch"],"url":"https://o3.security/vulnerability/CVE-2024-25817","summary":"eza Potential Heap Overflow Vulnerability for AArch64","details":"### Summary\nIn `eza`, there exists a potential heap overflow vulnerability, first seen when using Ubuntu for Raspberry Pi series system, on `ubuntu-raspi` kernel, relating to the `.git` directory.\n\n### Details\nThe vulnerability seems to be triggered by the `.git` directory in some projects. This issue may be related to specific files, and the directory structure also plays a role in triggering the vulnerability. Files/folders that may be involved in triggering the vulnerability include `.git/HEAD`, `.git/refs`, and `.git/objects`.\n\nAs @polly pointed out to me, this is likely caused by [GHSA-j2v7-4f6v-gpg8](https://github.com/libgit2/libgit2/security/advisories/GHSA-j2v7-4f6v-gpg8), which we do seem to use currently.\n\n### PoC\nFor more information check @CuB3y0nd's blogpost [blog](https://www.cubeyond.net/blog/eza-cve-report).\n\n### Impact\nArbitrary code execution.","published":"2024-03-06T00:15:52.703Z","modified":"2026-03-13T22:00:51.391389Z","cvss":{"score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"crates.io","name":"eza","fixedVersion":"0.18.2"}],"fix":{"url":"https://github.com/eza-community/eza/commit/47c9b90368c49117ba42760bd58acafa3362cbd4","label":"eza-community/eza@47c9b90"},"references":[{"type":"FIX","url":"https://github.com/advisories/GHSA-3qx3-6hxr-j2ch"},{"type":"ARTICLE","url":"https://www.cubeyond.net/blog/my-cves/eza-cve-report"},{"type":"WEB","url":"https://github.com/eza-community/eza/security/advisories/GHSA-3qx3-6hxr-j2ch"},{"type":"WEB","url":"https://github.com/eza-community/eza/commit/47c9b90368c49117ba42760bd58acafa3362cbd4"},{"type":"PACKAGE","url":"https://github.com/eza-community/eza"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-03-13T22:00:51.391389Z"}}