Lucene search
K
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Support
Settings
Sign in

Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Git vulnerabilities (USN-7626-1)

🗓️ 09 Jul 2025 00:00:00Reported by TenableType 
nessus
 nessus🔗 www.tenable.com👁 7 Views

Remote Ubuntu systems vulnerable to multiple Git issues, risking file access and code execution.

Related
Refs
Code
ReporterTitlePublishedViews
Family
FreeBSD		git -- multiple vulnerabilities
11 Apr 202500:00
–freebsd
GithubExploit		Exploit for Interpretation Conflict in Git-Scm Git
9 Sep 202504:57
–githubexploit
GithubExploit		Exploit for Link Following in Git-Scm Git
4 Dec 202512:17
–githubexploit
GithubExploit		Exploit for Interpretation Conflict in Git-Scm Git
14 Dec 202510:04
–githubexploit
GithubExploit		Exploit for Link Following in Git-Scm Git
16 Jul 202503:59
–githubexploit
GithubExploit		Exploit for CVE-2025-48384
9 Jul 202516:18
–githubexploit
GithubExploit		Exploit for Link Following in Git-Scm Git
8 Nov 202514:41
–githubexploit
GithubExploit		Exploit for Link Following in Git-Scm Git
29 Aug 202511:48
–githubexploit
GithubExploit		Exploit for CVE-2025-48384
11 Jul 202511:10
–githubexploit
Gitee		Exploit for CVE-2024-2961
27 Jul 202503:39
–gitee
Rows per page
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The descriptive text and package checks in this plugin were
# extracted from Ubuntu Security Notice USN-7626-1. The text
# itself is copyright (C) Canonical, Inc. See
# <https://ubuntu.com/security/notices>. Ubuntu(R) is a registered
# trademark of Canonical, Inc.
##

include('compat.inc');

if (description)
{
  script_id(241622);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/08/25");

  script_cve_id(
    "CVE-2025-27613",
    "CVE-2025-27614",
    "CVE-2025-46835",
    "CVE-2025-48384",
    "CVE-2025-48385",
    "CVE-2025-48386"
  );
  script_xref(name:"USN", value:"7626-1");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/09/15");

  script_name(english:"Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Git vulnerabilities (USN-7626-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote Ubuntu host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed
that are affected by multiple vulnerabilities as referenced in the USN-7626-1 advisory.

    Avi Halachmi discovered that Git incorrectly managed file modification constraints with Gitk. An attacker
    could possibly use this issue to create or write to arbitrary files on the system. (CVE-2025-27613)

    Avi Halachmi discovered that Git incorrectly handled arguments when invoking the Gitk utility. If a user
    were tricked into cloning a malicious Git repository, an attacker could possibly use this issue to run
    arbitrary commands. This issue only affected Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.
    (CVE-2025-27614)

    Johannes Sixt discovered that Git incorrectly managed file modification constraints with Git GUI. If a
    user were tricked into editing a file in a malicious Git repository, an attacker could possibly use this
    issue to create or write to arbitrary files on the system. (CVE-2025-46835)

    David Leadbeater discovered that Git incorrectly stripped CRLF characters when editing configuration
    files. An attacker could possibly use this issue to execute arbitrary code. (CVE-2025-48384)

    David Leadbeater discovered that Git incorrectly handled verification when fetching remote Git
    repositories. An attacker could possibly use this issue to perform protocol injection, leading to
    arbitrary code execution. This issue only affected Ubuntu 24.04 LTS, Ubuntu 24.10, and Ubuntu 25.04.
    (CVE-2025-48385)

    David Leadbeater discovered that Git incorrectly handled memory with the wincred credential helper. An
    attacker could possibly use this issue to cause a denial of service. (CVE-2025-48386)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://ubuntu.com/security/notices/USN-7626-1");
  script_set_attribute(attribute:"solution", value:
"Update the affected packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:A");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-48384");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2025-27614");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2025-48385");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/07/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/07/09");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:16.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:18.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:20.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:22.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.04:-:lts");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:24.10");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:canonical:ubuntu_linux:25.04");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-all");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-arch");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-core");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-cvs");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-daemon-run");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-daemon-sysvinit");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-el");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-email");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-gui");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-man");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-mediawiki");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:git-svn");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:gitk");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:canonical:ubuntu_linux:gitweb");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Ubuntu Local Security Checks");

  script_copyright(english:"Ubuntu Security Notice (C) 2025 Canonical, Inc. / NASL script (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info.nasl", "ubuntu_pro_sub_detect.nasl");
  script_require_keys("Host/cpu", "Host/Ubuntu", "Host/Ubuntu/release", "Host/Debian/dpkg-l");

  exit(0);
}

include('debian_package.inc');

if ( ! get_kb_item('Host/local_checks_enabled') ) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/Ubuntu/release');
if ( isnull(os_release) ) audit(AUDIT_OS_NOT, 'Ubuntu');
os_release = chomp(os_release);
if (! ('16.04' >< os_release || '18.04' >< os_release || '20.04' >< os_release || '22.04' >< os_release || '24.04' >< os_release || '24.10' >< os_release || '25.04' >< os_release)) audit(AUDIT_OS_NOT, 'Ubuntu 16.04 / 18.04 / 20.04 / 22.04 / 24.04 / 24.10 / 25.04', 'Ubuntu ' + os_release);
if ( ! get_kb_item('Host/Debian/dpkg-l') ) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'Ubuntu', cpu);
var ubuntu_pro_detected = get_kb_item('Host/Ubuntu/Pro/Services/esm-apps');
ubuntu_pro_detected = !empty_or_null(ubuntu_pro_detected);

var pro_caveat_needed = FALSE;

var pkgs = [
    {'osver': '16.04', 'pkgname': 'git', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-all', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-arch', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-core', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-cvs', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-daemon-run', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-daemon-sysvinit', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-el', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-email', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-gui', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-man', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-mediawiki', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'git-svn', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'gitk', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '16.04', 'pkgname': 'gitweb', 'pkgver': '1:2.7.4-0ubuntu1.10+esm9', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'git', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'git-all', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'git-cvs', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'git-daemon-run', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'git-daemon-sysvinit', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'git-el', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'git-email', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'git-gui', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'git-man', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'git-mediawiki', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'git-svn', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'gitk', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '18.04', 'pkgname': 'gitweb', 'pkgver': '1:2.17.1-1ubuntu0.18+esm2', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'git', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'git-all', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'git-cvs', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'git-daemon-run', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'git-daemon-sysvinit', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'git-el', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'git-email', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'git-gui', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'git-man', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'git-mediawiki', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'git-svn', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'gitk', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '20.04', 'pkgname': 'gitweb', 'pkgver': '1:2.25.1-1ubuntu3.14+esm1', 'ubuntu_pro': TRUE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'git', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'git-all', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'git-cvs', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'git-daemon-run', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'git-daemon-sysvinit', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'git-email', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'git-gui', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'git-man', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'git-mediawiki', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'git-svn', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'gitk', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '22.04', 'pkgname': 'gitweb', 'pkgver': '1:2.34.1-1ubuntu1.13', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'git', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'git-all', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'git-cvs', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'git-daemon-run', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'git-daemon-sysvinit', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'git-email', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'git-gui', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'git-man', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'git-mediawiki', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'git-svn', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'gitk', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.04', 'pkgname': 'gitweb', 'pkgver': '1:2.43.0-1ubuntu7.3', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'git', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'git-all', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'git-cvs', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'git-daemon-run', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'git-daemon-sysvinit', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'git-email', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'git-gui', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'git-man', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'git-mediawiki', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'git-svn', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'gitk', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '24.10', 'pkgname': 'gitweb', 'pkgver': '1:2.45.2-1ubuntu1.2', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '25.04', 'pkgname': 'git', 'pkgver': '1:2.48.1-0ubuntu1.1', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '25.04', 'pkgname': 'git-all', 'pkgver': '1:2.48.1-0ubuntu1.1', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '25.04', 'pkgname': 'git-cvs', 'pkgver': '1:2.48.1-0ubuntu1.1', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '25.04', 'pkgname': 'git-email', 'pkgver': '1:2.48.1-0ubuntu1.1', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '25.04', 'pkgname': 'git-gui', 'pkgver': '1:2.48.1-0ubuntu1.1', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '25.04', 'pkgname': 'git-man', 'pkgver': '1:2.48.1-0ubuntu1.1', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '25.04', 'pkgname': 'git-mediawiki', 'pkgver': '1:2.48.1-0ubuntu1.1', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '25.04', 'pkgname': 'git-svn', 'pkgver': '1:2.48.1-0ubuntu1.1', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '25.04', 'pkgname': 'gitk', 'pkgver': '1:2.48.1-0ubuntu1.1', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']},
    {'osver': '25.04', 'pkgname': 'gitweb', 'pkgver': '1:2.48.1-0ubuntu1.1', 'ubuntu_pro': FALSE, 'cves': ['CVE-2025-27613', 'CVE-2025-27614', 'CVE-2025-46835', 'CVE-2025-48384', 'CVE-2025-48385', 'CVE-2025-48386']}
];

var flag = 0;
foreach var package_array ( pkgs ) {
  var osver = NULL;
  var pkgname = NULL;
  var pkgver = NULL;
  if (!empty_or_null(package_array['osver'])) osver = package_array['osver'];
  if (!empty_or_null(package_array['pkgname'])) pkgname = package_array['pkgname'];
  if (!empty_or_null(package_array['pkgver'])) pkgver = package_array['pkgver'];
  if (!empty_or_null(package_array['cves'])) cves = package_array['cves'];
  var pro_required = NULL;
  if (!empty_or_null(package_array['ubuntu_pro'])) pro_required = package_array['ubuntu_pro'];
  if (osver && pkgname && pkgver) {
    if (deb_check(release:osver, prefix:pkgname, reference:pkgver, cves:cves)) {
        flag++;
        if (!ubuntu_pro_detected && !pro_caveat_needed) pro_caveat_needed = pro_required;
    }
  }
}

if (flag)
{
  var extra = '';
  if (pro_caveat_needed) {
    extra += 'NOTE: This vulnerability check contains fixes that apply to packages only \n';
    extra += 'available in Ubuntu ESM repositories. Access to these package security updates \n';
    extra += 'require an Ubuntu Pro subscription.\n\n';
  }
  extra += ubuntu_report_get();
  security_report_v4(
    port       : 0,
    severity   : SECURITY_HOLE,
    extra      : extra
  );
  exit(0);
}
else
{
  var tested = ubuntu_pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'git / git-all / git-arch / git-core / git-cvs / git-daemon-run / etc');
}

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

Book a live demo
25 Aug 2025 00:00Current
8.2High risk
Vulners AI Score8.2
CVSS 3.18.6
CVSS 48.6
EPSS0.02775
SSVC
ubuntu vulnerabilitiesgit vulnerabilitiesfile modificationarbitrary code executiondenial of service
7