CVE-2022-23521

CVE-2022-23521 affects Git. The issue arises from parsing gitattributes, where very large path patterns or attribute names can trigger integer overflows, leading to arbitrary heap reads/writes and potentially remote code execution. Git’s handling of long lines (>2KB) in gitattributes (from fil...

CVE-2022-41903

CVE-2022-41903 describes a heap-write overflow in Git during commit formatting when processing padding operators in pretty.c (format_and_pad_commit), where a size_t is mishandled as an int and added to memcpy() offsets. This can be triggered by commands using --format (e.g., git log) or indirectl...

CVE-2018-17456

CVE-2018-17456 is a remote code execution in Git triggered when processing a recursive clone of a superproject if a .gitmodules URL starts with a dash. Affected Git versions include 2.14.5 and later 2.15.x/2.16.x/2.17.x/2.18.x/2.19.x before the fixed releases listed (e.g., 2.14.5 and subsequent u...

CVE-2020-5260

CVE-2020-5260 affects Git by newline-injection in the credential helper protocol, enabling a crafted URL to exfiltrate credentials from one host to another. Affected Git releases were patched in April 2020; fixes are in 2.17.4, 2.18.3, 2.19.4, 2.20.3, 2.21.2, 2.22.3, 2.23.2, 2.24.2, 2.25.3, 2.26....

CVE-2019-19604

Git before 2.24.1 is vulnerable to arbitrary command execution via recursive submodule updates because a malicious .gitmodules can cause commands to be run. Affected ranges include 2.20.2, 2.21.x, 2.22.x, 2.23.x, and 2.24.x prior to 2.24.1. Remediation: upgrade to Git 2.24.1 or later (UPC/ALAS re...

CVE-2019-1353

CVE-2019-1353 concerns Git behavior under Windows Subsystem for Linux (WSL) when accessing a Windows NTFS working directory, where NTFS protections were not active. Connected documents link a related issue in libgit2 (NTFS filename handling) that can enable remote code execution during repository...

CVE-2014-9390

CVE-2014-9390 describes a remote command-execution risk in Git and several VCS clients when interacting with repositories on case-insensitive filesystems. A crafted .git/config in a tree can trigger arbitrary commands on the server/client, depending on the tool. Affected versions (per provided so...

CVE-2017-14867

CVE-2017-14867 affects Git and is caused by unsafe Perl scripts used to support subcommands (notably cvsserver). Vulnerable builds include Git before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2. The flaw allows an attacker to execute arbitrar...

CVE-2018-19486

CVE-2018-19486 : Git before 2.19.2 on Linux/UNIX executes commands from the current working directory in certain cases involving the run_command() API and run-command.c, caused by a change from execvp to execv in 2017. The vulnerability can allow commands to be executed from the current directory...