Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "git", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-all", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-arch", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-bzr", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-core", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-cvs", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-daemon-run", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-daemon-sysvinit", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-doc", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-el", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-email", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-gui", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-man", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-mediawiki", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "git-svn", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "gitk", "binary_version": "1:1.9.1-1ubuntu0.1" }, { "binary_name": "gitweb", "binary_version": "1:1.9.1-1ubuntu0.1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "mercurial", "binary_version": "2.8.2-1ubuntu1.3" }, { "binary_name": "mercurial-common", "binary_version": "2.8.2-1ubuntu1.3" }, { "binary_name": "mercurial-dbgsym", "binary_version": "2.8.2-1ubuntu1.3" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "jgit-cli", "binary_version": "3.7.1-2" }, { "binary_name": "libjgit-ant-java", "binary_version": "3.7.1-2" }, { "binary_name": "libjgit-java", "binary_version": "3.7.1-2" }, { "binary_name": "libjgit-java-doc", "binary_version": "3.7.1-2" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "medium", "binaries": [ { "binary_name": "libgit2-24", "binary_version": "0.24.1-2" }, { "binary_name": "libgit2-24-dbgsym", "binary_version": "0.24.1-2" }, { "binary_name": "libgit2-dev", "binary_version": "0.24.1-2" } ] }