CVE catalog

CVE-2014-9390

git: CVE-2014-9390

Severity: Critical · CVSS 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: Dec 18, 2014, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 75.60% · Oct 25, 2026

Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up to 0.21.2; Egit all versions before 08-12-2014; and JGit all versions before 08-12-2014 allow remote Git servers to execute arbitrary commands via a tree containing a crafted .git/config file with (1) an ignorable Unicode codepoint, (2) a git~1/config representation, or (3) mixed case that is improperly handled on a case-insensitive filesystem.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	git	sid	`1:2.55.0-1`	fixed
Debian	git	forky	`1:2.53.0-1`	fixed
Debian	git	trixie	`1:2.47.3-0+deb13u1`	fixed
Debian	git	bookworm	`1:2.39.5-0+deb12u3`	fixed
Debian	git	bookworm-security	`1:2.39.5-0+deb12u2`	fixed
Debian	jgit	sid	`6.7.0-2`	fixed
Debian	jgit	forky	`6.7.0-2`	fixed
Debian	jgit	trixie	`6.7.0-2`	fixed
Debian	jgit	bookworm	`4.11.9-2`	fixed
Debian	dulwich	sid	`1.2.17-1`	fixed
Debian	dulwich	forky	`1.2.17-1`	fixed
Debian	dulwich	trixie	`0.22.7-1`	fixed
Debian	dulwich	bookworm	`0.21.2-1`	fixed
Debian	libgit2	sid	`1.9.7+ds-1`	fixed
Debian	libgit2	forky	`1.9.7+ds-1`	fixed
Debian	libgit2	trixie	`1.9.0+ds-2+deb13u1`	fixed
Debian	libgit2	trixie-security	`1.9.0+ds-2+deb13u1`	fixed
Debian	libgit2	bookworm	`1.5.1+ds-1+deb12u1`	fixed
Debian	libgit2	bookworm-security	`1.5.1+ds-1+deb12u2`	fixed
Debian	mercurial	sid	`7.2.4-2`	fixed
Debian	mercurial	forky	`7.2.4-2`	fixed
Debian	mercurial	trixie	`7.0.1-2`	fixed
Debian	mercurial	bookworm	`6.3.2-1+deb12u1`	fixed
Debian	mercurial	bookworm-security	`6.3.2-1+deb12u1`	fixed
Ubuntu	git	14.04	`1:1.8.3.2-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.4.2-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.4.3-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.4.4-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.5-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.5.1-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.5.2-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.5.2-2`	vulnerable
Ubuntu	git	14.04	`1:1.8.5.3-1`	vulnerable
Ubuntu	git	14.04	`1:1.9~rc1-1`	vulnerable
Ubuntu	git	14.04	`1:1.9.0-1`	vulnerable
Ubuntu	git	14.04	`1:1.9.1-1`	vulnerable
Ubuntu	git	14.04	`1:1.9.1-1ubuntu0.1`	fixed
Ubuntu	mercurial	14.04	`2.6.3-1`	vulnerable
Ubuntu	mercurial	14.04	`2.7.2-1`	vulnerable
Ubuntu	mercurial	14.04	`2.8.1-2`	vulnerable
Ubuntu	mercurial	14.04	`2.8.2-1ubuntu1`	vulnerable
Ubuntu	mercurial	14.04	`2.8.2-1ubuntu1.3`	fixed
Ubuntu	libgit2	pro	`0.19.0-2`	vulnerable
Ubuntu	libgit2	pro	`0.19.0-2ubuntu0.4`	vulnerable
Ubuntu	libgit2	pro	`0.19.0-2ubuntu0.4+esm1`	vulnerable
Ubuntu	libgit2	pro	`0.19.0-2ubuntu0.4+esm2`	vulnerable
Ubuntu	git	14.04	`1:1.8.3.2-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.4.2-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.4.3-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.4.4-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.5-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.5.1-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.5.2-1`	vulnerable
Ubuntu	git	14.04	`1:1.8.5.2-2`	vulnerable
Ubuntu	git	14.04	`1:1.8.5.3-1`	vulnerable
Ubuntu	git	14.04	`1:1.9~rc1-1`	vulnerable
Ubuntu	git	14.04	`1:1.9.0-1`	vulnerable
Ubuntu	git	14.04	`1:1.9.1-1`	vulnerable
Ubuntu	git	14.04	`1:1.9.1-1ubuntu0.1`	fixed
Opensuse	git	tumbleweed	`2.11.0-1.1`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	git	source	sid	`1:2.1.4-1`	not yet assigned	Not reported	Not reported
Debian	git	source	forky	`1:2.1.4-1`	not yet assigned	Not reported	Not reported
Debian	git	source	trixie	`1:2.1.4-1`	not yet assigned	Not reported	Not reported
Debian	git	source	bookworm	`1:2.1.4-1`	not yet assigned	Not reported	Not reported
Debian	jgit	source	sid	`3.7.0-1`	not yet assigned	Not reported	[774050]
Debian	jgit	source	forky	`3.7.0-1`	not yet assigned	Not reported	[774050]
Debian	jgit	source	trixie	`3.7.0-1`	not yet assigned	Not reported	[774050]
Debian	jgit	source	bookworm	`3.7.0-1`	not yet assigned	Not reported	[774050]
Debian	dulwich	source	sid	`0.10.1-1`	not yet assigned	Not reported	Not reported
Debian	dulwich	source	forky	`0.10.1-1`	not yet assigned	Not reported	Not reported
Debian	dulwich	source	trixie	`0.10.1-1`	not yet assigned	Not reported	Not reported
Debian	dulwich	source	bookworm	`0.10.1-1`	not yet assigned	Not reported	Not reported
Debian	libgit2	source	sid	`0.21.3-1`	not yet assigned	Not reported	[774048]
Debian	libgit2	source	forky	`0.21.3-1`	not yet assigned	Not reported	[774048]
Debian	libgit2	source	trixie	`0.21.3-1`	not yet assigned	Not reported	[774048]
Debian	libgit2	source	bookworm	`0.21.3-1`	not yet assigned	Not reported	[774048]
Debian	mercurial	source	sid	`3.1.2-2`	not yet assigned	Not reported	[773640]
Debian	mercurial	source	forky	`3.1.2-2`	not yet assigned	Not reported	[773640]
Debian	mercurial	source	trixie	`3.1.2-2`	not yet assigned	Not reported	[773640]
Debian	mercurial	source	bookworm	`3.1.2-2`	not yet assigned	Not reported	[773640]
Ubuntu	git	deb	14.04	`1:1.9.1-1ubuntu0.1`	Not reported	UBUNTU-CVE-2014-9390	Not reported
Ubuntu	mercurial	deb	14.04	`2.8.2-1ubuntu1.3`	Not reported	UBUNTU-CVE-2014-9390	Not reported
Ubuntu	git	deb	14.04	`1:1.9.1-1ubuntu0.1`	Not reported	USN-2470-1	Not reported
Opensuse	git	rpm	tumbleweed	`2.11.0-1.1`	Not reported	OPENSUSE-SU-2024:10099-1	Not reported

[Debian bug #774050][Debian bug #774048][Debian bug #773640]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[git]Unknown
Details (4)
- 1:2.39.5-0+deb12u3 · amd64 · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · arm64 · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · amd64 · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · arm64 · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[git-all]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[git-cvs]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[git-daemon-run]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[git-daemon-sysvinit]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[git-doc]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[git-email]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[git-gui]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[gitk]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[git-man]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[git-mediawiki]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[git-svn]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[gitweb]Unknown
Source package: [git]
Details (4)
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u3 · all · bookworm
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
- 1:2.39.5-0+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:2.1.4-1
  dsa · git · debian · bookworm; dsa · git · debian · 12
[jgit-cli]Unknown
Source package: [jgit]
Details (2)
- 4.11.9-2 · all · bookworm
  Fixed · Fixed: 3.7.0-1
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12
- 4.11.9-2 · all · bookworm
  Fixed · Fixed: 3.7.0-1
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12
[libgit2-1.5]Unknown
Source package: [libgit2]
Details (4)
- 1.5.1+ds-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.5.1+ds-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.5.1+ds-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.5.1+ds-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
[libgit2-1.8]Unknown
Source package: [libgit2]
Details (2)
- 1.8.4+ds-3~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.8.4+ds-3~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
[libgit2-dev]Unknown
Source package: [libgit2]
Details (6)
- 1.5.1+ds-1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.5.1+ds-1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.8.4+ds-3~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.8.4+ds-3~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.5.1+ds-1+deb12u1 · amd64 · bookworm-security
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.5.1+ds-1+deb12u1 · arm64 · bookworm-security
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
[libgit2-fixtures]Unknown
Source package: [libgit2]
Details (6)
- 1.5.1+ds-1+deb12u1 · all · bookworm
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.5.1+ds-1+deb12u1 · all · bookworm
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.8.4+ds-3~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.8.4+ds-3~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.5.1+ds-1+deb12u1 · all · bookworm-security
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
- 1.5.1+ds-1+deb12u1 · all · bookworm-security
  Fixed · Fixed: 0.21.3-1
  dsa · libgit2 · debian · bookworm; dsa · libgit2 · debian · 12
[libjgit-ant-java]Unknown
Source package: [jgit]
Details (2)
- 4.11.9-2 · all · bookworm
  Fixed · Fixed: 3.7.0-1
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12
- 4.11.9-2 · all · bookworm
  Fixed · Fixed: 3.7.0-1
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12
[libjgit-java]Unknown
Source package: [jgit]
Details (2)
- 4.11.9-2 · all · bookworm
  Fixed · Fixed: 3.7.0-1
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12
- 4.11.9-2 · all · bookworm
  Fixed · Fixed: 3.7.0-1
  dsa · jgit · debian · bookworm; dsa · jgit · debian · 12

Next results

Observed: Oct 23, 2026, 5:12:53 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]