Most recent entries from all

ALSA-2025:11462 — Important: git security update

2026-10-02T22:37:19.179598+00:00

Affected: AlmaLinux:9: git, AlmaLinux:9: git-all, AlmaLinux:9: git-core, AlmaLinux:9: git-core-doc, AlmaLinux:9: git-credential-libsecret, AlmaLinux:9: git-daemon, AlmaLinux:9: git-email, AlmaLinux:9: git-gui, AlmaLinux:9: git-instaweb, AlmaLinux:9: git-subtree and 5 more

Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

* git: Git does not sanitize URLs when asking for credentials interactively (CVE-2024-50349) * git: Newline confusion in credential helpers can lead to credential exfiltration in git (CVE-2024-52006) * git: Git arbitrary code execution (CVE-2025-48384) * git: Git arbitrary file writes (CVE-2025-48385) * gitk: Git file creation flaw (CVE-2025-27613) * gitk: git script execution flaw (CVE-2025-27614) * git: Git GUI can create and overwrite files for which the user has write permission (CVE-2025-46835)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2025-08688

2026-10-02T22:37:19.179830+00:00

bdu:2025-08688

BELL-CVE-2025-48385

2026-10-02T22:37:19.179856+00:00

Affected: Alpaquita:23: git, Alpaquita:25: git, Alpaquita:stream: git

BIT-git-2025-48385 — Git alllows arbitrary file writes via bundle-uri parameter injection

2026-10-02T22:37:19.179883+00:00

Affected: Bitnami: git

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload parts of the clone to a CDN. The Git client does not perform sufficient validation of the advertised bundles, which allows the remote side to perform protocol injection. This protocol injection can cause the client to write the fetched bundle to a location controlled by the adversary. The fetched content is fully controlled by the server, which can in the worst case lead to arbitrary code execution. The use of bundle URIs is not enabled by default and can be controlled by the bundle.heuristic config option. Some cases of the vulnerability require that the adversary is in control of where a repository will be cloned to. This either requires social engineering or a recursive clone with submodules. These cases can thus be avoided by disabling recursive clones. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

certfr-2025-avi-0579 — De multiples vulnérabilités ont été découvertes dans les produits Microsoft. Certaines d'entre elles permettent à un at…

2026-10-02T22:37:19.179912+00:00

certfr-2025-avi-0579

EUVD-2026-259965

2026-10-02T22:37:19.179929+00:00

EUVD-2026-259965

fkie_cve-2025-48385

2026-10-02T22:37:19.179940+00:00

OESA-2025-1845 — git security update

2026-10-02T22:37:19.179979+00:00

Affected: openEuler:24.03-LTS: git

Security Fix(es):

A vulnerability was found in Microsoft Visual Studio (Programming Tool Software) (affected version not known). It has been classified as problematic.This is going to have an impact on confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-27613)

A vulnerability was found in Microsoft Visual Studio (Programming Tool Software) (the affected version unknown). It has been declared as problematic.As an impact it is known to affect confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-27614)

A vulnerability, which was classified as problematic, has been found in Microsoft Visual Studio (Programming Tool Software) (version unknown).Impacted is confidentiality, integrity, and availability.Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.(CVE-2025-46334)

A vulnerability was found in j6t git-gui up to 2.50.0 (Versioning Software). It has been rated as critical.Using CWE to declare the problem leads to CWE-88. The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, op…

openSUSE-SU-2025:15337-1 — git-2.50.1-1.1 on GA media

2026-10-02T22:37:19.180046+00:00

git-2.50.1-1.1 on GA media

RHSA-2025:11686 — Red Hat Security Advisory: git security update

2026-10-02T22:37:19.180070+00:00

git: Git arbitrary code execution git: Git arbitrary file writes

SUSE-SU-2025:20721-1 — Security update for git

2026-10-02T22:37:19.180095+00:00

Security update for git

UBUNTU-CVE-2025-48385

2026-10-02T22:37:19.180118+00:00

Affected: Ubuntu:24.04:LTS: git

WID-SEC-W-2025-1485 — Microsoft Developer Tools und git: Mehrere Schwachstellen

2026-10-02T22:37:19.180142+00:00

Ein Angreifer kann mehrere Schwachstellen in Microsoft Visual Studio, Microsoft Visual Studio Code und git ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, Daten zu manipulieren, einen Denial-of-Service-Zustand zu erzeugen und andere nicht spezifizierte Auswirkungen zu verursachen.