CVE-2015-7545
CriticalSummary
In Git versions before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1, there is a vulnerability that does not properly restrict allowed protocols in remote helper programs. This may allow remote attackers to execute arbitrary code via a URL in a .gitmodules file or other unknown sources in a submodule.
Risk Assessment
An attacker could exploit this vulnerability to execute arbitrary code remotely, posing a serious security threat to systems using the vulnerable versions of Git.
Recommendation
It is recommended to update Git to the latest version to eliminate this vulnerability and to implement additional precautions when managing .gitmodules files.
Other vulnerabilities in Git
See all- CVE-2017-14867High
Git versions before 2.10.5, 2.11.x before 2.11.4, 2.12.x before 2.12.5, 2.13.x before 2.13.6, and 2.14.x before 2.14.2 use unsafe Perl scripts to support subcommands, allowing attackers to execute arbitrary OS commands via shell metacharacters in a module name.
- CVE-2024-50349Medium
When Git asks for credentials via a terminal prompt (without using a credential helper), it prints the host name for which the credentials are requested. This may lead to unintended disclosure of the host name.
- CVE-2024-52006High
Git defines a line-based protocol used to exchange information between Git and Git credential helpers. Some ecosystems (most likely those using this protocol) may be vulnerable to attacks related to this protocol.
- CVE-2025-48385High
Git is a fast, scalable, distributed revision control system. When cloning a repository Git knows to optionally fetch a bundle advertised by the remote server, which allows the server-side to offload.
- CVE-2016-2324Critical
Integer overflow in Git before version 2.7.4 allows remote attackers to execute arbitrary code via (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow.
- CVE-2016-2315Critical
In git versions before 2.7.4, there is a bug in revision.c that uses an incorrect integer data type. This allows remote attackers to execute arbitrary code via (1) long filenames or (2) many nested trees, leading to a heap-based buffer overflow.
- CVE-2025-69160High
Gita versions up to 1.11 are vulnerable to unauthenticated local file inclusion.
Original NVD description (English source)
The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.