git -- Multiple vulnerabilities

git developers reports:

This update includes 2 security fixes:

CVE-2023-25652: By feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch)
CVE-2023-29007: A specially crafted .gitmodules file with submodule URLs that are longer than 1024 characters can used to exploit a bug that can be used to inject arbitrary configuration into user’s git config. This can result in arbitrary execution of code, by inserting values for core.pager, core.editor and so on