Early Access — Mondoo Vulnerability Intelligence is currently in preview.

UBUNTU-CVE-2025-48386 | Mondoo Vulnerability Intelligence

UBUNTU-CVE-2025-48386

MEDIUM6.3

Published Jul 8, 2025

Modified 6 months ago

Fix available

Details

Git is a fast, scalable, distributed revision control system with an unusually rich command set that provides both high-level operations and full access to internals. The wincred credential helper uses a static buffer (target) as a unique key for storing and comparing against internal storage. This credential helper does not properly bounds check the available space remaining in the buffer before appending to it with wcsncat(), leading to potential buffer overflows. This vulnerability is fixed in v2.43.7, v2.44.4, v2.45.4, v2.46.4, v2.47.3, v2.48.2, v2.49.1, and v2.50.1.

Affected Packages

Ubuntu:Pro:16.04:LTSgit

Affected versions:

1:2.5.0-11:2.6.2-11:2.6.3-11:2.6.4-11:2.7.0-11:2.7.0~rc3-11:2.7.3-0ubuntu11:2.7.4-0ubuntu11:2.7.4-0ubuntu1.11:2.7.4-0ubuntu1.10+15 more

Fixed in:

1:2.7.4-0ubuntu1.10+esm9

Ubuntu:Pro:18.04:LTSgit

Affected versions:

1:2.14.1-1ubuntu41:2.15.1-1ubuntu21:2.17.0-1ubuntu11:2.17.1-1ubuntu0.11:2.17.1-1ubuntu0.101:2.17.1-1ubuntu0.111:2.17.1-1ubuntu0.121:2.17.1-1ubuntu0.131:2.17.1-1ubuntu0.141:2.17.1-1ubuntu0.15+11 more

Fixed in:

1:2.17.1-1ubuntu0.18+esm2

Ubuntu:Pro:20.04:LTSgit

Affected versions:

1:2.20.1-2ubuntu11:2.24.0-1ubuntu11:2.24.0-1ubuntu21:2.25.0-1ubuntu11:2.25.1-1ubuntu11:2.25.1-1ubuntu21:2.25.1-1ubuntu31:2.25.1-1ubuntu3.11:2.25.1-1ubuntu3.101:2.25.1-1ubuntu3.11+10 more

Fixed in:

1:2.25.1-1ubuntu3.14+esm1

Ubuntu:22.04:LTSgit

Affected versions:

1:2.32.0-1ubuntu11:2.33.1-1ubuntu11:2.34.1-1ubuntu11:2.34.1-1ubuntu1.11:2.34.1-1ubuntu1.101:2.34.1-1ubuntu1.111:2.34.1-1ubuntu1.121:2.34.1-1ubuntu1.21:2.34.1-1ubuntu1.41:2.34.1-1ubuntu1.5+3 more

Fixed in:

1:2.34.1-1ubuntu1.13

Ubuntu:24.10git

Affected versions:

1:2.43.0-1ubuntu71:2.45.1-1ubuntu11:2.45.2-1ubuntu11:2.45.2-1ubuntu1.1

Fixed in:

1:2.45.2-1ubuntu1.2

Ubuntu:24.04:LTSgit

Affected versions:

1:2.40.1-1ubuntu11:2.43.0-1ubuntu11:2.43.0-1ubuntu51:2.43.0-1ubuntu61:2.43.0-1ubuntu71:2.43.0-1ubuntu7.11:2.43.0-1ubuntu7.2

Fixed in:

1:2.43.0-1ubuntu7.3

Ubuntu:25.04git

Affected versions:

1:2.45.2-1.2ubuntu11:2.45.2-1ubuntu11:2.47.1-0ubuntu11:2.47.1-1ubuntu11:2.48.1-0ubuntu1

Fixed in:

1:2.48.1-0ubuntu1.1

Ubuntu:16.04:LTSgit

Affected versions:

1:2.5.0-11:2.6.2-11:2.6.3-11:2.6.4-11:2.7.0-11:2.7.0~rc3-11:2.7.3-0ubuntu11:2.7.4-0ubuntu11:2.7.4-0ubuntu1.11:2.7.4-0ubuntu1.10+15 more

Ubuntu:18.04:LTSgit

Affected versions:

Ubuntu:20.04:LTSgit

Affected versions:

1:2.20.1-2ubuntu11:2.24.0-1ubuntu11:2.24.0-1ubuntu21:2.25.0-1ubuntu11:2.25.1-1ubuntu11:2.25.1-1ubuntu21:2.25.1-1ubuntu31:2.25.1-1ubuntu3.11:2.25.1-1ubuntu3.101:2.25.1-1ubuntu3.11+10 more

References

REPORThttps://ubuntu.com/security/CVE-2025-48386 ADVISORYhttps://ubuntu.com/security/notices/USN-7626-1 REPORThttps://www.cve.org/CVERecord?id=CVE-2025-48386 REPORThttps://www.openwall.com/lists/oss-security/2025/07/08/4

CVSS Analysis

CVSS v3.1

6.3

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

LowAC:L

Privileges Required

NonePR:N

User Interaction

RequiredUI:R

Scope

ChangedS:C

Impact

Confidentiality

HighC:H

Integrity

NoneI:N

Availability

NoneA:N

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Upstream

CVE-2025-48386

USN-7626-1

Ecosystems

Ubuntu Pro 16.04 LTS Ubuntu Pro 18.04 LTS Ubuntu Pro 20.04 LTS Ubuntu 22.04 LTS Ubuntu 24.10 Ubuntu 24.04 LTS Ubuntu 25.04 Ubuntu 16.04 LTS Ubuntu 18.04 LTS Ubuntu 20.04 LTS

Timeline

PublishedJul 8, 2025

ModifiedJul 11, 2025

UBUNTU-CVE-2025-48386

Details

Affected Packages

References

CVSS Analysis

Upstream

Related

Ecosystems

Timeline