Red Hat Security Advisory

RHSA-2016:0706

mercurial security update

Released 2016-05-02 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client Optional (v. 7) emacs-mercurial-2.6.2-6.el7_2, emacs-mercurial-el-2.6.2-6.el7_2, mercurial-2.6.2-6.el7_2 +1
Red Hat Enterprise Linux ComputeNode Optional (v. 7) emacs-mercurial-2.6.2-6.el7_2, emacs-mercurial-el-2.6.2-6.el7_2, mercurial-2.6.2-6.el7_2 +1
Red Hat Enterprise Linux Server (v. 7) mercurial-2.6.2-6.el7_2
Red Hat Enterprise Linux Server Optional (v. 7) emacs-mercurial-2.6.2-6.el7_2, emacs-mercurial-el-2.6.2-6.el7_2, mercurial-hgk-2.6.2-6.el7_2
Red Hat Enterprise Linux Workstation (v. 7) mercurial-2.6.2-6.el7_2
Red Hat Enterprise Linux Workstation Optional (v. 7) emacs-mercurial-2.6.2-6.el7_2, emacs-mercurial-el-2.6.2-6.el7_2, mercurial-hgk-2.6.2-6.el7_2

TI-2016-02569 CVE-2016-3069 · GHSA-8fm8-7365-5rh2

MEDIUM 46

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.04953 Published 2016-04-13 Partial fix · 3.7.3 CWE-20

TI-2016-02568 CVE-2016-3068 · GHSA-j7c2-rqm3-c97m

MEDIUM 46

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.05405 Published 2016-04-13 Fixed in 3.7.3 CWE-20