[SRCTREEWIN-9077] Remote Code Execution in Sourcetree for Windows, via Mercurial repo with Git subrepo - CVE-2018-13397 - Create and track feature requests for Atlassian products.

Type: Bug
Resolution: Fixed
Priority: Highest
Fix Version/s: 3.0.0-beta-1962
Affects Version/s: 2.6.9
Component/s: None
Labels:

Symptom Severity:
Severity 1 - Critical

There was an argument injection vulnerability in Sourcetree for Windows from version 0.5.1.0 before version 3.0.0 via Git subrepositories in Mercurial repositories. An attacker with permission to commit to a Mercurial repository linked in Sourcetree for Windows is able to exploit this issue to gain code execution on the system.

For additional details, see the full advisory

is related to

SRCTREE-5985 Remote Code Execution in Sourcetree for macOS, via Mercurial repo with Git subrepo - CVE-2018-13396

Closed

mentioned in: Page Failed to load; Page Failed to load

Assignee:: Unassigned

Reporter:: Security Metrics Bot

Affected customers:: 0 This affects my team

Watchers:: 1 Start watching this issue

Created:: 28/Aug/2018 4:38 AM

Updated:: 26/Aug/2019 5:16 AM

Resolved:: 11/Sep/2018 6:30 AM

Sourcetree for Windows

Details

Description

Attachments

Issue Links

Forms

Activity

[SRCTREEWIN-9077] Remote Code Execution in Sourcetree for Windows, via Mercurial repo with Git subrepo - CVE-2018-13397

People

Dates