UBUNTU-CVE-2025-27613

MEDIUM5.5

Published Jul 8, 2025

Modified 6 months ago

Fix available

Details

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

Affected Packages

git

Ubuntu Pro 16.04 LTS

Affected versions:

1:2.5.0-11:2.6.2-11:2.6.3-11:2.6.4-11:2.7.0-11:2.7.0~rc3-11:2.7.3-0ubuntu11:2.7.4-0ubuntu11:2.7.4-0ubuntu1.11:2.7.4-0ubuntu1.10+17 more

Fixed in:

1:2.7.4-0ubuntu1.10+esm11

git

Ubuntu Pro 18.04 LTS

Affected versions:

1:2.14.1-1ubuntu41:2.15.1-1ubuntu21:2.17.0-1ubuntu11:2.17.1-1ubuntu0.11:2.17.1-1ubuntu0.101:2.17.1-1ubuntu0.111:2.17.1-1ubuntu0.121:2.17.1-1ubuntu0.131:2.17.1-1ubuntu0.141:2.17.1-1ubuntu0.15+13 more

Fixed in:

1:2.17.1-1ubuntu0.18+esm4

git

Ubuntu Pro 20.04 LTS

Affected versions:

1:2.20.1-2ubuntu11:2.24.0-1ubuntu11:2.24.0-1ubuntu21:2.25.0-1ubuntu11:2.25.1-1ubuntu11:2.25.1-1ubuntu21:2.25.1-1ubuntu31:2.25.1-1ubuntu3.11:2.25.1-1ubuntu3.101:2.25.1-1ubuntu3.11+12 more

Fixed in:

1:2.25.1-1ubuntu3.14+esm3

git

Ubuntu 22.04 LTS

Affected versions:

1:2.32.0-1ubuntu11:2.33.1-1ubuntu11:2.34.1-1ubuntu11:2.34.1-1ubuntu1.11:2.34.1-1ubuntu1.101:2.34.1-1ubuntu1.111:2.34.1-1ubuntu1.121:2.34.1-1ubuntu1.131:2.34.1-1ubuntu1.141:2.34.1-1ubuntu1.2+5 more

Fixed in:

1:2.34.1-1ubuntu1.15

git

Ubuntu 24.10

Affected versions:

1:2.43.0-1ubuntu71:2.45.1-1ubuntu11:2.45.2-1ubuntu11:2.45.2-1ubuntu1.1

Fixed in:

1:2.45.2-1ubuntu1.2

git

Ubuntu 24.04 LTS

Affected versions:

1:2.40.1-1ubuntu11:2.43.0-1ubuntu11:2.43.0-1ubuntu51:2.43.0-1ubuntu61:2.43.0-1ubuntu71:2.43.0-1ubuntu7.11:2.43.0-1ubuntu7.2

Fixed in:

1:2.43.0-1ubuntu7.3

git

Ubuntu 25.04

Affected versions:

1:2.45.2-1.2ubuntu11:2.45.2-1ubuntu11:2.47.1-0ubuntu11:2.47.1-1ubuntu11:2.48.1-0ubuntu1

Fixed in:

1:2.48.1-0ubuntu1.1

git

Ubuntu 16.04 LTS

Affected versions:

1:2.5.0-11:2.6.2-11:2.6.3-11:2.6.4-11:2.7.0-11:2.7.0~rc3-11:2.7.3-0ubuntu11:2.7.4-0ubuntu11:2.7.4-0ubuntu1.11:2.7.4-0ubuntu1.10+17 more

git

Ubuntu 18.04 LTS

Affected versions:

git

Ubuntu 20.04 LTS

Affected versions:

1:2.20.1-2ubuntu11:2.24.0-1ubuntu11:2.24.0-1ubuntu21:2.25.0-1ubuntu11:2.25.1-1ubuntu11:2.25.1-1ubuntu21:2.25.1-1ubuntu31:2.25.1-1ubuntu3.11:2.25.1-1ubuntu3.101:2.25.1-1ubuntu3.11+12 more

References

REPORThttps://ubuntu.com/security/CVE-2025-27613 ADVISORYhttps://ubuntu.com/security/notices/USN-7626-1 ADVISORYhttps://ubuntu.com/security/notices/USN-7626-2 ADVISORYhttps://ubuntu.com/security/notices/USN-7626-3 REPORThttps://www.cve.org/CVERecord?id=CVE-2025-27613 REPORThttps://www.openwall.com/lists/oss-security/2025/07/08/4

CVSS Analysis

CVSS v3.1

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

NoneA:N

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Upstream

CVE-2025-27613

USN-7626-1 USN-7626-2 USN-7626-3

Ecosystems(10)

Ubuntu Pro 16.04 LTS Ubuntu Pro 18.04 LTS Ubuntu Pro 20.04 LTS Ubuntu 22.04 LTS Ubuntu 24.10

Timeline

PublishedJul 8, 2025

ModifiedJul 11, 2025

UBUNTU-CVE-2025-27613 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2025-27613

Details

Affected Packages

References

CVSS Analysis

Upstream

Related

Ecosystems(10)

Timeline