CVE-2016-3069

HIGH

Mercurial < 3.7.3 - Remote Code Execution via Git Repository Conversion

Title source: llm

Description

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

References (17)

Core 17

Core References

Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181505.html

Third Party Advisory vendor-advisory x_refsource_gentoo

https://security.gentoo.org/glsa/201612-19

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2016/dsa-3542

Issue Tracking, Patch x_refsource_confirm

https://selenic.com/repo/hg-stable/rev/b732e7f2aba4

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Issue Tracking, Patch x_refsource_confirm

https://selenic.com/repo/hg-stable/rev/197eed39e3d5

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00018.html

Issue Tracking, Patch x_refsource_confirm

https://selenic.com/repo/hg-stable/rev/cdda7b96afff

Third Party Advisory vendor-advisory x_refsource_redhat

http://rhn.redhat.com/errata/RHSA-2016-0706.html

Vendor Advisory x_refsource_confirm

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.7.3_.282016-3-29.29

Vendor Advisory x_refsource_confirm

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Issue Tracking, Patch x_refsource_confirm

https://selenic.com/repo/hg-stable/rev/80cac1de6aea

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00017.html

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00016.html

Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181542.html

Issue Tracking, Patch x_refsource_confirm

https://selenic.com/repo/hg-stable/rev/ae279d4a19e9

Third Party Advisory vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00043.html

Scores

CVSS v3 8.8

EPSS 0.0283

EPSS Percentile 86.4%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (18)

debian/debian_linux 7.0

debian/debian_linux 8.0

fedoraproject/fedora 22

fedoraproject/fedora 23

mercurial/mercurial < 3.7.2

opensuse/leap 42.1

opensuse/opensuse 13.2

pypi/mercurial 0 - 3.7.3PyPI

redhat/enterprise_linux_desktop 7.0

redhat/enterprise_linux_hpc_node 7.0

... and 8 more

Published Apr 13, 2016

Tracked Since Feb 18, 2026