Critical
Security advisory
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-2315
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 09:02 UTC · Revision 1
Source evidence
revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
osv:CVE-2016-2315
Complete source record
{
"id": "ecd782c01108fa5c86926694f5538fdd9519b63b8818c9a89a048158c0e17d14",
"url": "https://osv.dev/vulnerability/CVE-2016-2315",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-2315",
"summary": "revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.",
"evidence": "osv:CVE-2016-2315",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2016-2315",
"aliases": [
"CVE-2016-2315"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/git-for-windows/git",
"type": "GIT",
"events": [
{
"introduced": "594730e980521310d88006d91f3f14ef5eff1e2b"
},
{
"last_affected": "594730e980521310d88006d91f3f14ef5eff1e2b"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:git-scm:git:2.7.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.7.3"
},
{
"last_affected": "2.7.3"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.7.3",
"v2.7.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2315.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/git/git",
"type": "GIT",
"events": [
{
"introduced": "594730e980521310d88006d91f3f14ef5eff1e2b"
},
{
"last_affected": "594730e980521310d88006d91f3f14ef5eff1e2b"
},
{
"fixed": "34fa79a6cde56d6d428ab0d3160cb094ebad3305"
},
{
"fixed": "de1e67d0703894cb6ea782e36abb63976ab07e60"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:git-scm:git:2.7.3:*:*:*:*:*:*:*",
"range": [
{
"introduced": "2.7.3"
},
{
"last_affected": "2.7.3"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "34fa79a6cde56d6d428ab0d3160cb094ebad3305"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "de1e67d0703894cb6ea782e36abb63976ab07e60"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"2.7.3",
"v2.7.3"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-2315.json",
"vanir_signatures": [
{
"id": "CVE-2016-2315-104d7df7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"333696384022721386841054920728184909299",
"48045774154125439734741568040160695019",
"225069583955810248539134064612039576001",
"285220004273926721586991470031090570975",
"207318146699266144512094565345281883568"
]
},
"source": "https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305",
"target": {
"file": "fast-import.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-1247ab52",
"digest": {
"length": 194,
"function_hash": "86482523941693708903676221769142763047"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "pack-bitmap-write.c",
"function": "show_object"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-17d8ea95",
"digest": {
"threshold": 0.9,
"line_hashes": [
"4861392550014185053604563852680945285",
"70962342814146424007929177207417795489",
"291171301295482241896546329572056552471",
"155317780308335216064423533236627233294",
"110532300535431692778318665760980068499"
]
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "pack-bitmap-write.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-1ccb9230",
"digest": {
"length": 256,
"function_hash": "288100378935089578568872503519465894223"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "builtin/rev-list.c",
"function": "show_object"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-223330fe",
"digest": {
"length": 114,
"function_hash": "325276393784549001474003151192552946865"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "reachable.c",
"function": "mark_commit"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-28349444",
"digest": {
"threshold": 0.9,
"line_hashes": [
"70146829142773461071083184690264298982",
"197941069194735395928613667619132616266",
"209598121663717537000091369334802967422",
"220928915496619309823160263219967322391",
"75036903129962617877548747904255012856",
"88737337735187253093497808307623838280",
"113250685843459321534646254318880294506",
"162544930704649277490857850115035881973",
"329995704242119950506577551202154421668",
"279132520445407823173993872318714776094",
"312084085530689627715700014881167618858",
"305972687634275646802003503163880705681",
"282450779027242777542431974782687640695",
"87188921987300370993024484420489906897",
"322099123069337422844577328723106297636",
"5652169802873483528295943907971399684",
"101560160953240182835852504860489714617",
"167332710564992570932490313913530081685",
"260446277523963954737593493431264704185",
"283737627443877978151133376657294922014",
"68072624707116902550857964656813011327"
]
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "list-objects.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-3be6b8a7",
"digest": {
"threshold": 0.9,
"line_hashes": [
"141178588774867319040090048977069292037",
"95532322247239894981861591365896323583",
"288856492087438769885661556446629222083",
"8710360185724797378563528510987892988",
"45258962787700173668943380827187834032"
]
},
"source": "https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305",
"target": {
"file": "compat/nedmalloc/nedmalloc.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-434ee945",
"digest": {
"length": 151,
"function_hash": "53466673344511141317774105805771201567"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "builtin/pack-objects.c",
"function": "record_recent_object"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-44721628",
"digest": {
"length": 547,
"function_hash": "90785213450656997579291134798700043590"
},
"source": "https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305",
"target": {
"file": "revision.c",
"function": "path_name"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-506da011",
"digest": {
"threshold": 0.9,
"line_hashes": [
"249856302936842626318914084041505844981",
"39174862031684243678188043275559375541",
"331525110735146200939747754612845057235",
"10548614524708121848964223171591020776",
"159068503624613744659940280948738645606",
"305670468495556257678522520241990989874",
"247119326134630192571145320118233244993",
"186349392561089366486677648502622554758",
"240348107366842886033523584498256256747",
"316159076634938068384449309867972129846",
"232894955276676214547268895912686386333",
"141899374053831151990835062582966102817",
"189129866211932039055110424876844453046",
"117882580120918280172602107579257703508",
"77106939909077844666167147527745139194",
"44795547006358352217719954856113614284",
"203280564292980155009306062044403057553",
"210599027959183772221776771278493465507"
]
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "builtin/rev-list.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-54158c97",
"digest": {
"length": 311,
"function_hash": "187697293590959492104858751944841702826"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "pack-bitmap.c",
"function": "show_object"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-54fd7e22",
"digest": {
"length": 1451,
"function_hash": "245144354952552099008508166681611774293"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "list-objects.c",
"function": "process_tree"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-5527d2d1",
"digest": {
"length": 337,
"function_hash": "157515225737762462359487993761685263606"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "pack-bitmap.c",
"function": "test_show_object"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-5736ed1f",
"digest": {
"length": 334,
"function_hash": "160517248653732788859743432505621856451"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "revision.c",
"function": "show_object_with_name"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-5d591bcc",
"digest": {
"length": 143,
"function_hash": "52745623141942765136416085359571578296"
},
"source": "https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305",
"target": {
"file": "fast-import.c",
"function": "pool_strdup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-63dfcb1d",
"digest": {
"threshold": 0.9,
"line_hashes": [
"275218773086729375644981622952840841685",
"193575302911872523203612980083630274917",
"313237292679823937595656788072742461461",
"46518507861909767560913623238940478362",
"136548397855281478077355250242186649402",
"141662122499968825612028615981259949220",
"24498835406793561324898905596661583652",
"142898919047819576724395848902992196772",
"338730436133783752892539815060552676138",
"93541518082144254057521754034544366475",
"196893218462005064950343087778411323437"
]
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "reachable.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-6f86d49b",
"digest": {
"length": 163,
"function_hash": "28695504977565324158305268753340780301"
},
"source": "https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305",
"target": {
"file": "compat/nedmalloc/nedmalloc.c",
"function": "strdup"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-732759ff",
"digest": {
"threshold": 0.9,
"line_hashes": [
"277559095732014147899979516063770844628",
"279216415017285681121021901733579582966",
"125899750344678807507888977071787488520",
"62503580664546593996462493112431949747",
"240447924283610858212379569458817269465",
"66214503303098087824130137842198064556",
"308986824005070133695625392757645906182",
"125586708992025507710545370618713685152",
"261083069297851441849167855530966814562",
"118414560719103236254734951107732139093",
"275108665365488455919298175294499305914",
"91241956107740548016298853992640323776",
"71872543195215365961378425131263738234",
"132152680582038276688340065029033138421",
"259685253482397727148416909498719376971",
"218389677462078546917960733919803725543",
"140380081156221265791181677598260635898"
]
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "builtin/pack-objects.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-7b0d20c8",
"digest": {
"threshold": 0.9,
"line_hashes": [
"146535793819305778961375495019688816366",
"205672480898859299408150138780552136061",
"291171301295482241896546329572056552471",
"155317780308335216064423533236627233294",
"259774265004757002944831019218016176128",
"216014742029212482385335902440690688103",
"300457814905650515345358903708415317089",
"18168926194714079319082551696273614668",
"308407019117561664042698432980286106209",
"88606093332803866741795946558645339092",
"316559818927618815086202062923840392872",
"106486677798633845689997844412377741769",
"107179240230231382498858622873421694616",
"280920206130819783023327134345603569966",
"256737910877295365452787387450081266782",
"244551193698795247881847261280379902977",
"330339925368253886083364116287040152495",
"40045458917575994719170197298955554881",
"179097797924127511851795390098180291780",
"195188943391020056715839829642527654433"
]
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "pack-bitmap.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-7e76ded0",
"digest": {
"length": 381,
"function_hash": "56319272009654295954007311331073046398"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "builtin/rev-list.c",
"function": "finish_object"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-844e132e",
"digest": {
"threshold": 0.9,
"line_hashes": [
"175056807500528991003522803010929412528",
"338161945587528710931317714313259911219",
"81124370518328647219091633614093670588",
"208046837998431528875490097729748288758",
"200950013013403353091262057140930788295"
]
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "revision.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-84bab2a5",
"digest": {
"threshold": 0.9,
"line_hashes": [
"200909177789076378918771494602986366026",
"17502391705685587596211798716811567820",
"338025126927940698139090710584109332144",
"107858591837998904514550257371891333612"
]
},
"source": "https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305",
"target": {
"file": "revision.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-857d37c9",
"digest": {
"length": 192,
"function_hash": "326389011656334400671345592685210038757"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "revision.c",
"function": "path_name"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-8afe8fc9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"35573754703524822671708683005965600543",
"234912277190636788353193295952080496077",
"220157560850149040600208475093267633837"
]
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "list-objects.h"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-9e8fefb4",
"digest": {
"length": 284,
"function_hash": "80225387458769061186332595891932087333"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "builtin/pack-objects.c",
"function": "show_object"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-b52234b5",
"digest": {
"length": 118,
"function_hash": "106821476246760459903046627195560656903"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "reachable.c",
"function": "mark_object"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-bf7dd2d3",
"digest": {
"threshold": 0.9,
"line_hashes": [
"337271610863593087407638918388099427595",
"118363189014156960488481375965879841342",
"87534414695767879060696618391674947105",
"7204169397971973833718050724195704878",
"55611564722385374036687493148962819740",
"12256048680325649679564300047997249596",
"249114233626335298680088929863227132338",
"329768033099069420426439324217971560061",
"318810277049775957529838462900930741118",
"139575627352914238136965541722465456795",
"139656467155831591819978433487407333607",
"171808909712024012766512768702965405892",
"209711564536397590789175815125724611029",
"97942055277792133426936528072992105973",
"84087103158123495491407966308344229275",
"9246513225771645764980028042420059001",
"103512517227806769335783325770163091189",
"196302295134245941110206571709473378781",
"222967266967215457466568908367144905851",
"250000479794030983925820738920806225808",
"79864454862862813355826357379257004130"
]
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "revision.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-c18d9abf",
"digest": {
"length": 1040,
"function_hash": "279089347860008894253134245365687297669"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "list-objects.c",
"function": "traverse_commit_list"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-2315-d805a5ed",
"digest": {
"length": 372,
"function_hash": "170388918960624928317685435593119763410"
},
"source": "https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60",
"target": {
"file": "list-objects.c",
"function": "process_blob"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-24T14:03:59Z"
}
}
],
"modified": "2026-10-24T14:03:59.776010709Z",
"provider": "osv",
"references": [
"https://raw.githubusercontent.com/git/git/master/Documentation/RelNotes/2.7.4.txt",
"https://security.gentoo.org/glsa/201605-01",
"https://github.com/git/git/commit/34fa79a6cde56d6d428ab0d3160cb094ebad3305",
"https://github.com/git/git/commit/de1e67d0703894cb6ea782e36abb63976ab07e60"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "42.1"
},
{
"last_affected": "42.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:opensuse",
"extracted_events": [
{
"range": [
{
"introduced": "13.2"
},
{
"last_affected": "13.2"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:suse:linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*"
],
"vendor_product": "suse:linux_enterprise_debuginfo",
"extracted_events": [
{
"range": [
{
"introduced": "11-sp4"
},
{
"last_affected": "11-sp4"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:suse:linux_enterprise_server:12:sp1:*:*:*:*:*:*"
],
"vendor_product": "suse:linux_enterprise_server",
"extracted_events": [
{
"range": [
{
"introduced": "12-sp1"
},
{
"last_affected": "12-sp1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp4:*:*:*:*:*:*",
"cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:*:*:*:*:*:*:*",
"cpe:2.3:o:suse:linux_enterprise_software_development_kit:12:sp1:*:*:*:*:*:*"
],
"vendor_product": "suse:linux_enterprise_software_development_kit",
"extracted_events": [
{
"range": [
{
"introduced": "11-sp4"
},
{
"last_affected": "11-sp4"
},
{
"introduced": "12"
},
{
"last_affected": "12"
},
{
"introduced": "12-sp1"
},
{
"last_affected": "12-sp1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:suse:openstack_cloud:5:*:*:*:*:*:*:*"
],
"vendor_product": "suse:openstack_cloud",
"extracted_events": [
{
"range": [
{
"introduced": "5"
},
{
"last_affected": "5"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:suse:suse_linux_enterprise_server:12:*:*:*:*:*:*:*"
],
"vendor_product": "suse:suse_linux_enterprise_server",
"extracted_events": [
{
"range": [
{
"introduced": "12"
},
{
"last_affected": "12"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-2315",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442882,
"published_at": "2016-04-08T14:59:01.187+00:00"
}