CVE-2014-9938

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

contrib/completion/git-prompt.sh in Git before 1.9.3 does not sanitize branch names in the PS1 variable, allowing a malicious repository to cause code execution.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-116

Affected software

VendorProductVersions
n/an/an/a

References

Timeline

Published
Mar 20, 2017
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2014

CVE-2014-99399.8ihex.c in GNU Binutils before 2.26 contains a stack buffer overflow when printing bad bytes in Intel Hex objects.CVE-2014-99407.0The regulator_ena_gpio_free function in drivers/regulator/core.c in the Linux kernel before 3.19 allows local users to gain privileges or caCVE-2014-99417.0In the Embedded File System in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerabilitCVE-2014-99427.8In Boot in all Android releases from CAF using the Linux kernel, a Use of Uninitialized Variable vulnerability could potentially exist.CVE-2014-99437.8In Core Kernel in all Android releases from CAF using the Linux kernel, a Null Pointer Dereference vulnerability could potentially exist.CVE-2014-99447.8In the Secure File System in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability coulCVE-2014-99457.8In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist.CVE-2014-99467.8In Core Kernel in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist.CVE-2014-99475.5In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure vulnerability could potentially exist.CVE-2014-99487.8In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Validation of Array Index vulnerability could potentially CVE-2014-99497.8In TrustZone in all Android releases from CAF using the Linux kernel, an Untrusted Pointer Dereference vulnerability could potentially existCVE-2014-99507.8In Core Kernel in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist.
CVE-2014-9938: High severity, CVSS 8.8 | Vulnix