For whatever it's worth, I just downloaded 1.9.5 for Windows from https://msysgit.github.io/. While the release notes don't mention "CVE-2014-9390" explicitly, it does say this:

Changes since Git-1.9.4-preview20140929

New Features ...

Bugfixes

* Safeguards against bogus file names on NTFS.

Edit: Actually, there it is on their git hub releases page. https://github.com/msysgit/msysgit/releases/tag/Git-1.9.5-pr...