PatchTheCVECVE-2012-4465: Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authe
CVE-2012-4465 is a medium-severity flaw (CVSS 6.5) affecting cgit. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" field in a commit.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 6.5 (Medium) |
| EPSS exploit chance | 3.4% (top 11%) |
| CISA exploited list | No |
| Weakness | CWE-119 |
| Published | 2012-10-10 |
| Last modified | 2026-06-16 |
Last updated 2026-06-16 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2012-4465?
cgit: upgrade to newer than 0.9.0.3. Exact commands for each OS are on this page.
Is CVE-2012-4465 being exploited?
CVE-2012-4465 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2012-4465 affect?
CVE-2012-4465 affects cgit. Severity is medium (CVSS 6.5). Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via an empty username in the "Author" fiel
How urgent is CVE-2012-4465?
Priority 45/100. No elevated risk signals yet.
Related CVEs
- CVE-2018-14912 HIGH 7.5 UPGRADE MITIGATE cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is
- CVE-2016-1901 CRITICAL 9.8 MITIGATE UPGRADE Integer overflow in the authenticate_post function in CGit before 0.12 allows remote attackers to have unspeci
- CVE-2016-1900 LOW 3.7 MITIGATE UPGRADE CRLF injection vulnerability in the cgit_print_http_headers function in ui-shared.c in CGit before 0.12 allows
- CVE-2016-1899 LOW 3.7 MITIGATE UPGRADE CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbi
- CVE-2013-2117 MEDIUM 4.3 UPGRADE DOWNGRADE Directory traversal vulnerability in the cgit_parse_readme function in ui-summary.c in cgit before 0.9.2, when