SB2025082983 - SUSE update for git

Description

This security bulletin contains information about 3 secuirty vulnerabilities.

1) Protection Mechanism Failure (CVE-ID: CVE-2025-27613)

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists in Gitk when cloning an untrusted repository and executing Gitk without additional command arguments. A remote attacker can abuse such behavior and overwrite or truncate any files on the system. 

Successful exploitation of the vulnerability requires that the "Support per-file encoding" option is enabled. 

2) Product UI does not warn user of unsafe actions (CVE-ID: CVE-2025-46835)

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to missing notifications in Git GUI when performing potentially dangerous actions. When a user clones an untrusted repository and is tricked into editing a file located in a maliciously named directory in the repository, then Git GUI can create and overwrite any writable file.

3) CRLF injection (CVE-ID: CVE-2025-48384)

The vulnerability allows a remote user to compromise the affected system.

The vulnerability exists due to insufficient validation of attacker-supplied data when reading config values. A remote user can pass specially crafted config lines to the application containing CR-LF characters and execute arbitrary code on the system after checkout.

Remediation

Install update from vendor's website.

References

• https://www.suse.com/support/update/announcement/2025/suse-su-202503022-1/