NVD

Id
36305  
Name
CVE-2014-9706  
Description
The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-03-31  
Modified Date
2015-04-14  
Seq
2014-9706  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
185665 36305 CVE-2014-9706 FEDORA-2015-4575  View
185666 36305 CVE-2014-9706 FEDORA-2015-4534  View
185667 36305 CVE-2014-9706 DSA-3206  View
185668 36305 CVE-2014-9706 [oss-security] 20150321 Possible CVE Request: dulwich: does not prevent to write files in commits with invalid paths to working tree  View
185669 36305 CVE-2014-9706 [oss-security] 20150322 Re: Possible CVE Request: dulwich: does not prevent to write files in commits with invalid paths to working tree  View
185670 36305 CVE-2014-9706 https://git.samba.org/?p=jelmer/dulwich.git;a=commitdiff;h=091638be3c89f46f42c3b1d57dc1504af5729176  View
185671 36305 CVE-2014-9706 [dulwich-users] 20141219 Re: Git vulnerability CVE-2014-9390  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
19130 JVNDB-2014-008005 Dulwich の index.py の build_index_from_tree 関数における任意のコードを実行される脆弱性 Dulwich の index.py の build_index_from_tree 関数には、任意のコードを実行される脆弱性が存在します。 CVE-2014-9706 76999 CVE-2014-9706 36305 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-008005.html 2014-12-19 2015-04-03 View