Remote Code Execution via Git and Mercurial - (CVE-2017-1000117, CVE-2017-1000115, CVE-2017-1000116)

SourceTree for Windows is affected by vulnerabilities found in the Git and Mercurial software. This vulnerability can be triggered through a malicious repository when it is checked out using SourceTree. From version 0.8.4b of SourceTree for Windows this vulnerability can be triggered from a webpage through the use of the SourceTree URI handler.

Affected versions:

• Versions of SourceTree for Windows starting with 0.5.1.0 before version 2.1.10 are affected by this vulnerability.

Fix:

• Upgrade SourceTree for Windows to version 2.1.10 or higher from https://www.sourcetreeapp.com/

For additional details see the full advisory.