Tracker / CVE-2014-9390
CVE-2014-9390
Critical 9.8
Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
Affected products and versions
| apple | xcode |
|---|---|
| apple | xcode · … → 6.1.1 |
| eclipse | egit · … → 08-12-2014 |
| eclipse | jgit · … → 3.4.2 |
| eclipse | jgit · 3.5.0 → 3.5.3 |
| git-scm | git · … → 1.8.5.6 |
| git-scm | git · 1.9.0 → 1.9.5 |
| git-scm | git · 2.0.0 → 2.0.5 |
| git-scm | git · 2.1.0 → 2.1.4 |
| git-scm | git · 2.2.0 → 2.2.1 |
| libgit2 | libgit2 · … → 0.21.3 |
| mercurial | mercurial · … → 3.2.3 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.