Avih

Name of the Vulnerable Software and Affected Versions: Git versions 2.43.7 through 2.49.1 Description: The issue allows for the creation and truncation of any writable file when a user clones an untrusted repository and runs Gitk without additional command arguments, provided the "Support per-file encoding" option is enabled. Additionally, the operation "Show origin of this line" is affected, regardless of the option being enabled or not. Multiple vulnerabilities were fixed in Git, including arbitrary code execution and buffer overflows. Recommendations: For Git versions 2.43.7 through 2.49.1, update to a version newer than 2.49.1 to resolve the issue. As a temporary workaround, consider disabling the "Support per-file encoding" option and restricting the use of Gitk until a patch is available. Avoid using the "Show origin of this line" operation in Gitk for untrusted repositories until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Gitk versions 2.41.0 through 2.43.6 Git versions 2.50.1-alt1 **Description** Gitk, a Tcl/Tk based Git history browser, contains a flaw where a crafted Git repository can be used to trick a user into executing arbitrary scripts with their user privileges via the `gitk filename` command. This is possible due to a lack of sanitization of special elements. Exploitation requires social engineering. **Recommendations** Update Gitk to version 2.43.7 or later. Update Git to version 2.50.1-alt1.