Libgit2 contained multiple vulnerabilities related to incorrect handling of Git Smart Protocol packets, empty packet lines, HTTP transport error reporting, crafted 'ng' packets, repository index files, submodule paths, delta object result-size headers, and HTTP redirects. These flaws could be exploited remotely or locally to cause denial of service, arbitrary code execution, server spoofing, unauthorized file writes, or credential leakage. The vulnerabilities affect Ubuntu LTS versions 14.04 through 26.04, with specific issues impacting different releases. Ubuntu has released patches and security notices (USN-8628-1) addressing these vulnerabilities, with fixes available via standard system updates or Ubuntu Pro ESM for supported versions.

The vulnerabilities in libgit2 could allow remote attackers to cause denial of service or execute arbitrary code, spoof servers, write files outside the working tree, or leak credentials to offsite redirect targets. The impact varies by specific vulnerability and affected Ubuntu LTS version. No known exploits in the wild have been reported. The CVSS score of 5.3 indicates a medium severity level with network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability (denial of service) in some cases.

A fix is available. Users should apply the security updates provided by Ubuntu as detailed in the Ubuntu Security Notice USN-8628-1. For Ubuntu Pro customers, fixes are available via Extended Security Maintenance (ESM). Standard system updates will apply the necessary patches to affected libgit2 packages. No additional mitigation steps are indicated beyond applying these updates.