Linux · Security advisory · May 22, 2023

ALSA-2023:3245: Security update for 15 packages

ALSA-2023:3245, released May 22, 2023, fixes 5 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.5188
98th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 3 Routine 2

Fixed package versions

ProductReleaseFixed in
gitalmalinux 92.39.3-1.el9_2
git-allalmalinux 92.39.3-1.el9_2
git-corealmalinux 92.39.3-1.el9_2
git-core-docalmalinux 92.39.3-1.el9_2
git-credential-libsecretalmalinux 92.39.3-1.el9_2
git-daemonalmalinux 92.39.3-1.el9_2
git-emailalmalinux 92.39.3-1.el9_2
git-guialmalinux 92.39.3-1.el9_2
git-instawebalmalinux 92.39.3-1.el9_2
git-subtreealmalinux 92.39.3-1.el9_2
git-svnalmalinux 92.39.3-1.el9_2
gitkalmalinux 92.39.3-1.el9_2
gitwebalmalinux 92.39.3-1.el9_2
perl-Gitalmalinux 92.39.3-1.el9_2
perl-Git-SVNalmalinux 92.39.3-1.el9_2

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-25652 GitHub: CVE-2023-25652 "git apply --reject" partially-controlled arbitrary file write 7.5 0.5188 Exploitation Less Likely
High CVE-2023-29007 GitHub: CVE-2023-29007 Arbitrary configuration injection via `git submodule deinit` 7.8 0.0561 Exploitation Less Likely
High CVE-2023-23946 GitHub: CVE-2023-23946 mingit Remote Code Execution Vulnerability 7.5 0.0114 Exploitation Less Likely
Routine CVE-2023-25815 GitHub: CVE-2023-25815 Git looks for localized messages in an unprivileged place 2.2 0.0084 Exploitation Less Likely
Routine CVE-2023-22490 GitHub: CVE-2023-22490 mingit Information Disclosure Vulnerability 5.5 0.0071 Exploitation Less Likely
Showing 1 to 5 of 5 1