CVE-2014-9706: Critical severity Debian Debian Linux vulnerability
The buildindexfromtree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.
Other sources
The buildindexfromtree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9706?
CVE-2014-9706 is a high severity vulnerability that allows remote attackers to execute arbitrary code.
How do I fix CVE-2014-9706?
You can fix CVE-2014-9706 by upgrading to dulwich version 0.9.9 or later.
What software is affected by CVE-2014-9706?
CVE-2014-9706 affects dulwich versions prior to 0.9.9 and Debian GNU/Linux version 7.0.
Can CVE-2014-9706 be exploited remotely?
Yes, CVE-2014-9706 can be exploited remotely through a crafted commit.
What function is vulnerable in CVE-2014-9706?
The vulnerable function in CVE-2014-9706 is the build_index_from_tree function in index.py.