← Back

CVE-2014-9390

nvd nist
Published: Feb 12, 2020Modified: Nov 21, 2024

JSON object

Loading...
9.8
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability: 3.9 / Impact: 5.9
Source: NVD

Description

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Affected (13)

Products: Git Scm: Git · Mercurial: Mercurial · Apple: Xcode · +2 more
Show all products
Git Scm: Git · Mercurial: Mercurial · Apple: Xcode · Eclipse: Egit, Jgit · Libgit2: Libgit2
Git Scm
1 product
Git
Mercurial
1 product
Mercurial
Apple
1 product
Xcode
Eclipse
2 products
Egit
Jgit
Libgit2
1 product
Libgit2
Configuration A
5 vulnerable
Vulnerable SoftwareAffected Versions
Git Scm
Git
Before 1.8.5.6
Git
From 1.9.0 to 1.9.5
Git
From 2.0.0 to 2.0.5
Git
From 2.1.0 to 2.1.4
Git
From 2.2.0 to 2.2.1
Configuration B
1 vulnerable · 2 platform
Vulnerable SoftwareAffected Versions
Mercurial
Before 3.2.3
Running on/withPlatform Versions
Apple
Mac Os X
All versions
Microsoft
Windows
All versions
Configuration C
3 vulnerable
Vulnerable SoftwareAffected Versions
Apple
Xcode
Up to 6.1.1
Xcode
Version 6.2
Xcode
Version 6.2 beta_2
Configuration D
4 vulnerable
Vulnerable SoftwareAffected Versions
Egit
Before 08-12-2014
Eclipse
Jgit
Before 3.4.2
Jgit
From 3.5.0 to 3.5.3
Libgit2
Before 0.21.3

Related CWEs

CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (18)

Source: cve@mitre.org
Broken Link
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Release NotesThird Party Advisory
Source: cve@mitre.org
Third Party AdvisoryVDB Entry
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Vendor Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Product
Source: cve@mitre.org
Issue TrackingPatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Release NotesThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Product
Source: af854a3a-2127-422b-91ae-364da2661108
Issue TrackingPatchThird Party Advisory

Timeline

No history available yet.