CVE-2014-9938
Fixed in a distro release EPSS 2%
contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution.
Products: git-scm git
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | git | 1:2.0.0~rc2-1 |
| Debian 13 | git | 1:2.0.0~rc2-1 |
| Debian 14 | git | 1:2.0.0~rc2-1 |
| Red Hat Enterprise Linux 7 | emacs-git | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | emacs-git-el | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | git | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | git-all | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | git-bzr | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | git-cvs | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | git-daemon | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | git-debuginfo | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | git-email | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | git-gui | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | git-hg | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | git-p4 | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | git-svn | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | gitk | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | gitweb | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | perl-Git | 0:1.8.3.1-11.el7 |
| Red Hat Enterprise Linux 7 | perl-Git-SVN | 0:1.8.3.1-11.el7 |
| Ubuntu 14.04 LTS | git | 1:1.9.1-1ubuntu0.4 |