cygwin vulnerabilities

Products

• cygwin 2
• git 1

Latest cygwin CVEs

Newest publication first

1. CVE-2021-29468 Arbitrary code execution when checking out an attacker-controlled Git branch

   Published 2021-04-29

   High·CVSS 8.8 EPSS 1.2%

   Cygwin Git is a patch set for the git command line tool for the cygwin environment. A specially crafted repository that contains symbolic links as well as files with backslash characters in the file name may cause just-checked out code to be executed while checking out a reposito...

2. CVE-2017-7523 Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting into denial-of-service by crashing the process or potential hij...

   Published 2017-07-21

   High·CVSS 7.5 EPSS 2.7%

   Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow vulnerability in wcsxfrm/wcsxfrm_l functions resulting into denial-of-service by crashing the process or potential hijack of the process running with administrative privileges triggered by specially...

3. CVE-2016-3067 Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.

   Published 2017-04-21

   Critical·CVSS 9.8 EPSS 2.0%

   Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.