Linux · Security advisory · May 22, 2023

ALSA-2023:3246: Security update for 15 packages

ALSA-2023:3246, released May 22, 2023, fixes 5 CVEs across 15 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.5188
98th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 3 Routine 2

Fixed package versions

ProductReleaseFixed in
gitalmalinux 82.39.3-1.el8_8
git-allalmalinux 82.39.3-1.el8_8
git-corealmalinux 82.39.3-1.el8_8
git-core-docalmalinux 82.39.3-1.el8_8
git-credential-libsecretalmalinux 82.39.3-1.el8_8
git-daemonalmalinux 82.39.3-1.el8_8
git-emailalmalinux 82.39.3-1.el8_8
git-guialmalinux 82.39.3-1.el8_8
git-instawebalmalinux 82.39.3-1.el8_8
git-subtreealmalinux 82.39.3-1.el8_8
git-svnalmalinux 82.39.3-1.el8_8
gitkalmalinux 82.39.3-1.el8_8
gitwebalmalinux 82.39.3-1.el8_8
perl-Gitalmalinux 82.39.3-1.el8_8
perl-Git-SVNalmalinux 82.39.3-1.el8_8

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2023-25652 GitHub: CVE-2023-25652 "git apply --reject" partially-controlled arbitrary file write 7.5 0.5188 Exploitation Less Likely
High CVE-2023-29007 GitHub: CVE-2023-29007 Arbitrary configuration injection via `git submodule deinit` 7.8 0.0561 Exploitation Less Likely
High CVE-2023-23946 GitHub: CVE-2023-23946 mingit Remote Code Execution Vulnerability 7.5 0.0114 Exploitation Less Likely
Routine CVE-2023-25815 GitHub: CVE-2023-25815 Git looks for localized messages in an unprivileged place 2.2 0.0084 Exploitation Less Likely
Routine CVE-2023-22490 GitHub: CVE-2023-22490 mingit Information Disclosure Vulnerability 5.5 0.0071 Exploitation Less Likely
Showing 1 to 5 of 5 1