Debian Git vulnerabilities

CVE-2025-48384 [HIGH] CVE-2025-48384: git - Git is a fast, scalable, distributed revision control system with an unusually r... Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. When reading a config value, Git strips any trailing carriage return and line feed (CRLF). When writing a config entry, values with a trailing CR are not quoted, causing the CR to be lost when the config i

CVE-2018-17456 [CRITICAL] CVE-2018-17456: git - Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.1... Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a '-' character. Scope: local bookworm: resolved (fixed in 1:2.19.1-1) bullseye: resolved (

CVE-2014-9390 [CRITICAL] CVE-2014-9390: dulwich - Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, ... Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git s

CVE-2021-21300 [HIGH] CVE-2021-21300: git - Git is an open-source distributed revision control system. In affected versions ... Git is an open-source distributed revision control system. In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS (i.e. the default file systems on Win

CVE-2017-1000117 [HIGH] CVE-2017-1000117: git - A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting vi... A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on the victim's machine being executed. Such a URL could be placed in the .gitmodules file of a malicious project, and an unsuspecting victim could be tricked into running "git clone --recurse-submodules" to trig

CVE-2018-11235 [HIGH] CVE-2018-11235: git - In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before ... In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur. With a crafted .gitmodules file, a malicious project can execute an arbitrary script on a machine that runs "git clone --recurse-submodules" because submodule "names" are obtained from this file, and then appended to $GIT_DIR

CVE-2022-23521 [CRITICAL] CVE-2022-23521: git - Git is distributed revision control system. gitattributes are a mechanism to all... Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `.gitattributes` file to the repository, which contains a set of file patterns and the attributes that should be set for paths matching this pattern. When parsing gitattributes, multiple integer overflows can o

CVE-2022-41903 [CRITICAL] CVE-2022-41903: git - Git is distributed revision control system. `git log` can display commits in an ... Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also exposed to `git archive` via the `export-subst` gitattribute. When processing the padding operators, there is a integer overflow in `pretty.c::format_and_pad_commit()` where a `size_t` is stored improperly as an

CVE-2024-32002 [CRITICAL] CVE-2024-32002: git - Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42... Git is a revision control system. Prior to versions 2.45.1, 2.44.1, 2.43.4, 2.42.2, 2.41.1, 2.40.2, and 2.39.4, repositories with submodules can be crafted in a way that exploits a bug in Git whereby it can be fooled into writing files not into the submodule's worktree but into a `.git/` directory. This allows writing a hook that will be executed while the clone ope

CVE-2017-14867 [HIGH] CVE-2017-14867: git - Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.1... Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 uses unsafe Perl scripts to support subcommands such as cvsserver, which allows attackers to execute arbitrary OS commands via shell metacharacters in a module name. The vulnerable code is reachable via git-shell even without CVS support. Scope: local bookworm:

CVE-2015-7545 [CRITICAL] CVE-2015-7545: git - The (1) git-remote-ext and (2) unspecified other remote helper programs in Git b... The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule. Scope: local bookworm:

CVE-2023-25652 [HIGH] CVE-2023-25652: git - Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33... Git is a revision control system. Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to `git apply --reject`, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the rejected hunk(s) from the given patch). A fix is available i

CVE-2016-2324 [CRITICAL] CVE-2016-2324: cgit - Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrar... Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2019-1349 [HIGH] CVE-2019-1349: git - A remote code execution vulnerability exists when Git for Visual Studio improper... A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1350, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387. Scope: local bookworm: resolved (fixed in 1:2.24.0-2) bullseye: resolved (fixed in 1:2.24.0-2) forky: resolved (fixed in 1

CVE-2016-2315 [CRITICAL] CVE-2016-2315: cgit - revision.c in git before 2.7.4 uses an incorrect integer data type, which allows... revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2019-1350 [HIGH] CVE-2019-1350: git - A remote code execution vulnerability exists when Git for Visual Studio improper... A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1352, CVE-2019-1354, CVE-2019-1387. Scope: local bookworm: resolved (fixed in 1:2.24.0-2) bullseye: resolved (fixed in 1:2.24.0-2) forky: resolved (fixed in 1

CVE-2019-1352 [HIGH] CVE-2019-1352: git - A remote code execution vulnerability exists when Git for Visual Studio improper... A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1354, CVE-2019-1387. Scope: local bookworm: resolved (fixed in 1:2.24.0-2) bullseye: resolved (fixed in 1:2.24.0-2) forky: resolved (fixed in 1

CVE-2019-1354 [HIGH] CVE-2019-1354: git - A remote code execution vulnerability exists when Git for Visual Studio improper... A remote code execution vulnerability exists when Git for Visual Studio improperly sanitizes input, aka 'Git for Visual Studio Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1349, CVE-2019-1350, CVE-2019-1352, CVE-2019-1387. Scope: local bookworm: resolved (fixed in 1:2.24.0-2) bullseye: resolved (fixed in 1:2.24.0-2) forky: resolved (fixed in 1

CVE-2017-8386 [HIGH] CVE-2017-8386: git - git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x be... git-shell in git before 2.4.12, 2.5.x before 2.5.6, 2.6.x before 2.6.7, 2.7.x before 2.7.5, 2.8.x before 2.8.5, 2.9.x before 2.9.4, 2.10.x before 2.10.3, 2.11.x before 2.11.2, and 2.12.x before 2.12.3 might allow remote authenticated users to gain privileges via a repository name that starts with a - (dash) character. Scope: local bookworm: resolved (fixed in 1:2.11.0-3)

CVE-2022-39260 [HIGH] CVE-2022-39260: git - Git is an open source, scalable, distributed revision control system. `git shell... Git is an open source, scalable, distributed revision control system. `git shell` is a restricted login shell that can be used to implement Git's push/pull functionality via SSH. In versions prior to 2.30.6, 2.31.5, 2.32.4, 2.33.5, 2.34.5, 2.35.5, 2.36.3, and 2.37.4, the function that splits the command arguments into an array improperly uses an `int` to represent the n