Early Access — Mondoo Vulnerability Intelligence is currently in preview.

UBUNTU-CVE-2025-27613 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2025-27613

MEDIUM5.5

Published Jul 8, 2025

Modified 6 months ago

Fix available

Details

Gitk is a Tcl/Tk based Git history browser. Starting with 1.7.0, when a user clones an untrusted repository and runs gitk without additional command arguments, files for which the user has write permission can be created and truncated. The option Support per-file encoding must have been enabled before in Gitk's Preferences. This option is disabled by default. The same happens when Show origin of this line is used in the main window (regardless of whether Support per-file encoding is enabled or not). This vulnerability is fixed in 2.43.7, 2.44.4, 2.45.4, 2.46.4, 2.47.3, 2.48.2, 2.49.1, and 2.50.1.

Affected Packages

Ubuntu:Pro:16.04:LTSgit

Affected versions:

1:2.5.0-11:2.6.2-11:2.6.3-11:2.6.4-11:2.7.0-11:2.7.0~rc3-11:2.7.3-0ubuntu11:2.7.4-0ubuntu11:2.7.4-0ubuntu1.11:2.7.4-0ubuntu1.10+17 more

Fixed in:

1:2.7.4-0ubuntu1.10+esm11

Ubuntu:Pro:18.04:LTSgit

Affected versions:

1:2.14.1-1ubuntu41:2.15.1-1ubuntu21:2.17.0-1ubuntu11:2.17.1-1ubuntu0.11:2.17.1-1ubuntu0.101:2.17.1-1ubuntu0.111:2.17.1-1ubuntu0.121:2.17.1-1ubuntu0.131:2.17.1-1ubuntu0.141:2.17.1-1ubuntu0.15+13 more

Fixed in:

1:2.17.1-1ubuntu0.18+esm4

Ubuntu:Pro:20.04:LTSgit

Affected versions:

1:2.20.1-2ubuntu11:2.24.0-1ubuntu11:2.24.0-1ubuntu21:2.25.0-1ubuntu11:2.25.1-1ubuntu11:2.25.1-1ubuntu21:2.25.1-1ubuntu31:2.25.1-1ubuntu3.11:2.25.1-1ubuntu3.101:2.25.1-1ubuntu3.11+12 more

Fixed in:

1:2.25.1-1ubuntu3.14+esm3

Ubuntu:22.04:LTSgit

Affected versions:

1:2.32.0-1ubuntu11:2.33.1-1ubuntu11:2.34.1-1ubuntu11:2.34.1-1ubuntu1.11:2.34.1-1ubuntu1.101:2.34.1-1ubuntu1.111:2.34.1-1ubuntu1.121:2.34.1-1ubuntu1.131:2.34.1-1ubuntu1.141:2.34.1-1ubuntu1.2+5 more

Fixed in:

1:2.34.1-1ubuntu1.15

Ubuntu:24.10git

Affected versions:

1:2.43.0-1ubuntu71:2.45.1-1ubuntu11:2.45.2-1ubuntu11:2.45.2-1ubuntu1.1

Fixed in:

1:2.45.2-1ubuntu1.2

Ubuntu:24.04:LTSgit

Affected versions:

1:2.40.1-1ubuntu11:2.43.0-1ubuntu11:2.43.0-1ubuntu51:2.43.0-1ubuntu61:2.43.0-1ubuntu71:2.43.0-1ubuntu7.11:2.43.0-1ubuntu7.2

Fixed in:

1:2.43.0-1ubuntu7.3

Ubuntu:25.04git

Affected versions:

1:2.45.2-1.2ubuntu11:2.45.2-1ubuntu11:2.47.1-0ubuntu11:2.47.1-1ubuntu11:2.48.1-0ubuntu1

Fixed in:

1:2.48.1-0ubuntu1.1

Ubuntu:16.04:LTSgit

Affected versions:

1:2.5.0-11:2.6.2-11:2.6.3-11:2.6.4-11:2.7.0-11:2.7.0~rc3-11:2.7.3-0ubuntu11:2.7.4-0ubuntu11:2.7.4-0ubuntu1.11:2.7.4-0ubuntu1.10+17 more

Ubuntu:18.04:LTSgit

Affected versions:

Ubuntu:20.04:LTSgit

Affected versions:

1:2.20.1-2ubuntu11:2.24.0-1ubuntu11:2.24.0-1ubuntu21:2.25.0-1ubuntu11:2.25.1-1ubuntu11:2.25.1-1ubuntu21:2.25.1-1ubuntu31:2.25.1-1ubuntu3.11:2.25.1-1ubuntu3.101:2.25.1-1ubuntu3.11+12 more

References

REPORThttps://ubuntu.com/security/CVE-2025-27613 ADVISORYhttps://ubuntu.com/security/notices/USN-7626-1 ADVISORYhttps://ubuntu.com/security/notices/USN-7626-2 ADVISORYhttps://ubuntu.com/security/notices/USN-7626-3 REPORThttps://www.cve.org/CVERecord?id=CVE-2025-27613 REPORThttps://www.openwall.com/lists/oss-security/2025/07/08/4

CVSS Analysis

CVSS v3.1

5.5

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

NoneC:N

Integrity

LowI:L

Availability

NoneA:N

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N

Upstream

CVE-2025-27613

USN-7626-1 USN-7626-2 USN-7626-3

Ecosystems

Ubuntu Pro 16.04 LTS Ubuntu Pro 18.04 LTS Ubuntu Pro 20.04 LTS Ubuntu 22.04 LTS Ubuntu 24.10 Ubuntu 24.04 LTS Ubuntu 25.04 Ubuntu 16.04 LTS Ubuntu 18.04 LTS Ubuntu 20.04 LTS

Timeline

PublishedJul 8, 2025

ModifiedJul 11, 2025

UBUNTU-CVE-2025-27613

Details

Affected Packages

References

CVSS Analysis

Upstream

Related

Ecosystems

Timeline