Skip to content
OpenAdvisories
High ELSA-2016-0706 2 CVEs

Important: mercurial security update (Oracle Linux 7)

Published May 2, 2016 · Updated May 2, 2016

Ecosystem: Oracle Linux

Summary

[2.6.2-6]
- fix previous patch for CVE-2016-3069

[2.6.2-5]
- Fix CVE-2016-3068 and CVE-2016-3069

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 7 emacs-mercurial 0:2.6.2-6.el7_2
Oracle Linux · 7 emacs-mercurial-el 0:2.6.2-6.el7_2
Oracle Linux · 7 mercurial 0:2.6.2-6.el7_2
Oracle Linux · 7 mercurial-hgk 0:2.6.2-6.el7_2

Vulnerabilities 2

  • High 8.8
    CVE-2016-3068

    Mercurial arbitrary code execution via a crafted git ext:: URL

    Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.

    mercurial mercurial mercurial Debian Ubuntu PyPI
  • High 8.8
    CVE-2016-3069

    Mercurial vulnerable to arbitrary code execution via a crafted name when converting a Git repository

    Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

    mercurial mercurial mercurial Debian Ubuntu PyPI