UBUNTU-CVE-2025-48386

MEDIUM6.3

Published Jul 8, 2025

Modified 6 months ago

Fix available

Details

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Affected Packages

git

Ubuntu Pro 16.04 LTS

Affected versions:

1:2.5.0-11:2.6.2-11:2.6.3-11:2.6.4-11:2.7.0-11:2.7.0~rc3-11:2.7.3-0ubuntu11:2.7.4-0ubuntu11:2.7.4-0ubuntu1.11:2.7.4-0ubuntu1.10+15 more

Fixed in:

1:2.7.4-0ubuntu1.10+esm9

git

Ubuntu Pro 18.04 LTS

Affected versions:

1:2.14.1-1ubuntu41:2.15.1-1ubuntu21:2.17.0-1ubuntu11:2.17.1-1ubuntu0.11:2.17.1-1ubuntu0.101:2.17.1-1ubuntu0.111:2.17.1-1ubuntu0.121:2.17.1-1ubuntu0.131:2.17.1-1ubuntu0.141:2.17.1-1ubuntu0.15+11 more

Fixed in:

1:2.17.1-1ubuntu0.18+esm2

git

Ubuntu Pro 20.04 LTS

Affected versions:

1:2.20.1-2ubuntu11:2.24.0-1ubuntu11:2.24.0-1ubuntu21:2.25.0-1ubuntu11:2.25.1-1ubuntu11:2.25.1-1ubuntu21:2.25.1-1ubuntu31:2.25.1-1ubuntu3.11:2.25.1-1ubuntu3.101:2.25.1-1ubuntu3.11+10 more

Fixed in:

1:2.25.1-1ubuntu3.14+esm1

git

Ubuntu 22.04 LTS

Affected versions:

1:2.32.0-1ubuntu11:2.33.1-1ubuntu11:2.34.1-1ubuntu11:2.34.1-1ubuntu1.11:2.34.1-1ubuntu1.101:2.34.1-1ubuntu1.111:2.34.1-1ubuntu1.121:2.34.1-1ubuntu1.21:2.34.1-1ubuntu1.41:2.34.1-1ubuntu1.5+3 more

Fixed in:

1:2.34.1-1ubuntu1.13

git

Ubuntu 24.10

Affected versions:

1:2.43.0-1ubuntu71:2.45.1-1ubuntu11:2.45.2-1ubuntu11:2.45.2-1ubuntu1.1

Fixed in:

1:2.45.2-1ubuntu1.2

git

Ubuntu 24.04 LTS

Affected versions:

1:2.40.1-1ubuntu11:2.43.0-1ubuntu11:2.43.0-1ubuntu51:2.43.0-1ubuntu61:2.43.0-1ubuntu71:2.43.0-1ubuntu7.11:2.43.0-1ubuntu7.2

Fixed in:

1:2.43.0-1ubuntu7.3

git

Ubuntu 25.04

Affected versions:

1:2.45.2-1.2ubuntu11:2.45.2-1ubuntu11:2.47.1-0ubuntu11:2.47.1-1ubuntu11:2.48.1-0ubuntu1

Fixed in:

1:2.48.1-0ubuntu1.1

git

Ubuntu 16.04 LTS

Affected versions:

1:2.5.0-11:2.6.2-11:2.6.3-11:2.6.4-11:2.7.0-11:2.7.0~rc3-11:2.7.3-0ubuntu11:2.7.4-0ubuntu11:2.7.4-0ubuntu1.11:2.7.4-0ubuntu1.10+15 more

git

Ubuntu 18.04 LTS

Affected versions:

git

Ubuntu 20.04 LTS

Affected versions:

1:2.20.1-2ubuntu11:2.24.0-1ubuntu11:2.24.0-1ubuntu21:2.25.0-1ubuntu11:2.25.1-1ubuntu11:2.25.1-1ubuntu21:2.25.1-1ubuntu31:2.25.1-1ubuntu3.11:2.25.1-1ubuntu3.101:2.25.1-1ubuntu3.11+10 more

References

REPORThttps://ubuntu.com/security/CVE-2025-48386 ADVISORYhttps://ubuntu.com/security/notices/USN-7626-1 REPORThttps://www.cve.org/CVERecord?id=CVE-2025-48386 REPORThttps://www.openwall.com/lists/oss-security/2025/07/08/4

CVSS Analysis

CVSS v3.1

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Upstream

CVE-2025-48386

USN-7626-1

Ecosystems(10)

Ubuntu Pro 16.04 LTS Ubuntu Pro 18.04 LTS Ubuntu Pro 20.04 LTS Ubuntu 22.04 LTS Ubuntu 24.10

Timeline

PublishedJul 8, 2025

ModifiedJul 11, 2025

UBUNTU-CVE-2025-48386 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2025-48386

Details

Affected Packages

References

CVSS Analysis

Upstream

Related

Ecosystems(10)

Timeline