CVE ID:	CVE-2014-9706
Description:	The build_index_from_tree function in index.py in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.
Test IDs:	1.3.6.1.4.1.25623.1.0.869226   1.3.6.1.4.1.25623.1.0.869686   1.3.6.1.4.1.25623.1.0.869227   1.3.6.1.4.1.25623.1.0.703206
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2014-9706 Debian Security Information: DSA-3206 (Google Search) http://www.debian.org/security/2015/dsa-3206 http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154551.html http://lists.fedoraproject.org/pipermail/package-announce/2015-April/154523.html https://lists.launchpad.net/dulwich-users/msg00827.html http://www.openwall.com/lists/oss-security/2015/03/21/1 http://www.openwall.com/lists/oss-security/2015/03/22/26