CVE-2016-3630

HIGH

Mercurial <3.7.3 - Remote Code Execution

Title source: manual
STIX 2.1

Description

The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone, (2) push, or (3) pull command, related to (a) a list sizing rounding error and (b) short records.

References (12)

Core 12
Core References
Mailing List, Vendor Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181505.html
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201612-19
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2016/dsa-3542
Third Party Advisory x_refsource_confirm
https://selenic.com/repo/hg-stable/rev/b9714d958e89
Third Party Advisory x_refsource_confirm
https://selenic.com/repo/hg-stable/rev/b6ed2505d6cf
Mailing List, Vendor Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00018.html
Mailing List, Vendor Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00017.html
Mailing List, Vendor Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00016.html
Mailing List, Vendor Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181542.html
Mailing List, Vendor Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00043.html

Scores

CVSS v3 8.8
EPSS 0.0519
EPSS Percentile 90.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-19
Status published
Products (11)
debian/debian_linux 7.0
debian/debian_linux 8.0
fedoraproject/fedora 22
fedoraproject/fedora 23
mercurial/mercurial < 3.7.2
opensuse/leap 42.1
opensuse/opensuse 13.2
pypi/mercurial 0 - 3.7.3PyPI
suse/linux_enterprise_debuginfo 11 sp4
suse/linux_enterprise_software_development_kit 11 sp4
... and 1 more
Published Apr 13, 2016
Tracked Since Feb 18, 2026