diff options
| author | Renato Botelho <garga@FreeBSD.org> | 2025-07-08 14:09:44 -0300 |
|---|---|---|
| committer | Renato Botelho <garga@FreeBSD.org> | 2025-07-08 14:19:09 -0300 |
| commit | 1bd91518d50c9abade64445524c272d17f9aa43c (patch) | |
| tree | 53d9ceab84ef0015e7aa2345c753a8d7e2201fb6 /security | |
| parent | devel/py-types-jsonschema: update to 4.24.0.20250708 (diff) | |
security/vuxml: Add multiple git vulnerabilities
* CVE-2025-27613
* CVE-2025-27614
* CVE-2025-46835
* CVE-2025-48384
* CVE-2025-48385
* CVE-2025-48386
Sponsored by: Rubicon Communications, LLC ("Netgate")
Diffstat (limited to 'security')
| -rw-r--r-- | security/vuxml/vuln/2025.xml | 88 |
1 files changed, 88 insertions, 0 deletions
diff --git a/security/vuxml/vuln/2025.xml b/security/vuxml/vuln/2025.xml index d36ddddbedfe..e4159b1dc703 100644 --- a/security/vuxml/vuln/2025.xml +++ b/security/vuxml/vuln/2025.xml @@ -1,3 +1,91 @@ + <vuln vid="2a4472ed-5c0d-11f0-b991-291fce777db8"> + <topic>git -- multiple vulnerabilities</topic> + <affects> + <package> + <name>git</name> + <name>git-cvs</name> + <name>git-gui</name> + <name>git-p4</name> + <name>git-svn</name> + <range><lt>2.50.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Git development team reports:</p> + <blockquote cite="https://lore.kernel.org/git/xmqq5xg2wrd1.fsf@gitster.g"> + <p>CVE-2025-27613: Gitk: + When a user clones an untrusted repository and runs Gitk without + additional command arguments, any writable file can be created and + truncated. The option "Support per-file encoding" must have been + enabled. The operation "Show origin of this line" is affected as + well, regardless of the option being enabled or not. + </p> + <p>CVE-2025-27614: Gitk: + A Git repository can be crafted in such a way that a user who has + cloned the repository can be tricked into running any script + supplied by the attacker by invoking `gitk filename`, where + `filename` has a particular structure. + </p> + <p>CVE-2025-46835: Git GUI: + When a user clones an untrusted repository and is tricked into + editing a file located in a maliciously named directory in the + repository, then Git GUI can create and overwrite any writable + file. + </p> + <p>CVE-2025-48384: Git: + When reading a config value, Git strips any trailing carriage + return and line feed (CRLF). When writing a config entry, values + with a trailing CR are not quoted, causing the CR to be lost when + the config is later read. When initializing a submodule, if the + submodule path contains a trailing CR, the altered path is read + resulting in the submodule being checked out to an incorrect + location. If a symlink exists that points the altered path to the + submodule hooks directory, and the submodule contains an executable + post-checkout hook, the script may be unintentionally executed + after checkout. + </p> + <p>CVE-2025-48385: Git: + When cloning a repository Git knows to optionally fetch a bundle + advertised by the remote server, which allows the server-side to + offload parts of the clone to a CDN. The Git client does not + perform sufficient validation of the advertised bundles, which + allows the remote side to perform protocol injection. + This protocol injection can cause the client to write the fetched + bundle to a location controlled by the adversary. The fetched + content is fully controlled by the server, which can in the worst + case lead to arbitrary code execution. + </p> + <p>CVE-2025-48386: Git: + The wincred credential helper uses a static buffer (`target`) as a + unique key for storing and comparing against internal storage. This + credential helper does not properly bounds check the available + space remaining in the buffer before appending to it with + `wcsncat()`, leading to potential buffer overflows. + </p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2025-27613</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27613</url> + <cvename>CVE-2025-27614</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27614</url> + <cvename>CVE-2025-46835</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46835</url> + <cvename>CVE-2025-48384</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48384</url> + <cvename>CVE-2025-48385</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48385</url> + <cvename>CVE-2025-48386</cvename> + <url>https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48386</url> + </references> + <dates> + <discovery>2025-04-11</discovery> + <entry>2025-07-08</entry> + </dates> + </vuln> + <vuln vid="79251dc8-5bc5-11f0-834f-b42e991fc52e"> <topic>MongoDB -- Incorrect Handling of incomplete data may prevent mongoS from Accepting New Connections</topic> <affects> |