git: 1bd91518d50c - main - security/vuxml: Add multiple git vulnerabilities
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Tue, 08 Jul 2025 17:19:40 UTC
The branch main has been updated by garga:
URL: https://cgit.FreeBSD.org/ports/commit/?id=1bd91518d50c9abade64445524c272d17f9aa43c
commit 1bd91518d50c9abade64445524c272d17f9aa43c
Author: Renato Botelho <garga@FreeBSD.org>
AuthorDate: 2025-07-08 17:09:44 +0000
Commit: Renato Botelho <garga@FreeBSD.org>
CommitDate: 2025-07-08 17:19:09 +0000
security/vuxml: Add multiple git vulnerabilities
* CVE-2025-27613
* CVE-2025-27614
* CVE-2025-46835
* CVE-2025-48384
* CVE-2025-48385
* CVE-2025-48386
Sponsored by: Rubicon Communications, LLC ("Netgate")
---
security/vuxml/vuln/2025.xml | 88 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 88 insertions(+)
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml
index d36ddddbedfe..e4159b1dc703 100644
--- a/security/vuxml/vuln/2025.xml
+++ b/security/vuxml/vuln/2025.xml
@@ -1,3 +1,91 @@
+ <vuln vid="2a4472ed-5c0d-11f0-b991-291fce777db8">
+ <topic>git -- multiple vulnerabilities</topic>
+ <affects>
+ <package>
+ <name>git</name>
+ <name>git-cvs</name>
+ <name>git-gui</name>
+ <name>git-p4</name>
+ <name>git-svn</name>
+ <range><lt>2.50.1</lt></range>
+ </package>
+ </affects>
+ <description>
+ <body xmlns="http://www.w3.org/1999/xhtml">
+ <p>Git development team reports:</p>
+ <blockquote cite="https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g">
+ <p>CVE-2025-27613: Gitk:
+ When a user clones an untrusted repository and runs Gitk without
+ additional command arguments, any writable file can be created and
+ truncated. The option "Support per-file encoding" must have been
+ enabled. The operation "Show origin of this line" is affected as
+ well, regardless of the option being enabled or not.
+ </p>
+ <p>CVE-2025-27614: Gitk:
+ A Git repository can be crafted in such a way that a user who has
+ cloned the repository can be tricked into running any script
+ supplied by the attacker by invoking `gitk filename`, where
+ `filename` has a particular structure.
+ </p>
+ <p>CVE-2025-46835: Git GUI:
+ When a user clones an untrusted repository and is tricked into
+ editing a file located in a maliciously named directory in the
+ repository, then Git GUI can create and overwrite any writable
+ file.
+ </p>
+ <p>CVE-2025-48384: Git:
+ When reading a config value, Git strips any trailing carriage
+ return and line feed (CRLF). When writing a config entry, values
+ with a trailing CR are not quoted, causing the CR to be lost when
+ the config is later read. When initializing a submodule, if the
+ submodule path contains a trailing CR, the altered path is read
+ resulting in the submodule being checked out to an incorrect
+ location. If a symlink exists that points the altered path to the
+ submodule hooks directory, and the submodule contains an executable
+ post-checkout hook, the script may be unintentionally executed
+ after checkout.
+ </p>
+ <p>CVE-2025-48385: Git:
+ When cloning a repository Git knows to optionally fetch a bundle
+ advertised by the remote server, which allows the server-side to
+ offload parts of the clone to a CDN. The Git client does not
+ perform sufficient validation of the advertised bundles, which
+ allows the remote side to perform protocol injection.
+ This protocol injection can cause the client to write the fetched
+ bundle to a location controlled by the adversary. The fetched
+ content is fully controlled by the server, which can in the worst
+ case lead to arbitrary code execution.
+ </p>
+ <p>CVE-2025-48386: Git:
+ The wincred credential helper uses a static buffer (`target`) as a
+ unique key for storing and comparing against internal storage. This
+ credential helper does not properly bounds check the available
+ space remaining in the buffer before appending to it with
+ `wcsncat()`, leading to potential buffer overflows.
+ </p>
+ </blockquote>
+ </body>
+ </description>
+ <references>
+ <cvename>CVE-2025-27613</cvename>
+ <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27613</url>
+ <cvename>CVE-2025-27614</cvename>
+ <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27614</url>
+ <cvename>CVE-2025-46835</cvename>
+ <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46835</url>
+ <cvename>CVE-2025-48384</cvename>
+ <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48384</url>
+ <cvename>CVE-2025-48385</cvename>
+ <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48385</url>
+ <cvename>CVE-2025-48386</cvename>
+ <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48386</url>
+ </references>
+ <dates>
+ <discovery>2025-04-11</discovery>
+ <entry>2025-07-08</entry>
+ </dates>
+ </vuln>
+
<vuln vid="79251dc8-5bc5-11f0-834f-b42e991fc52e">
<topic>MongoDB -- Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections</topic>
<affects>