Skip to content
OpenAdvisories
High RHSA-2016:0706 2 CVEs

Red Hat Security Advisory: mercurial security update

Published Sep 15, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client emacs-mercurial 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client emacs-mercurial-el 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client mercurial 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client mercurial-debuginfo 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::client mercurial-hgk 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode emacs-mercurial 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode emacs-mercurial-el 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode mercurial 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode mercurial-debuginfo 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::computenode mercurial-hgk 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server emacs-mercurial 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server emacs-mercurial-el 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server mercurial 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server mercurial-debuginfo 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::server mercurial-hgk 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation emacs-mercurial 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation emacs-mercurial-el 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation mercurial 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation mercurial-debuginfo 0:2.6.2-6.el7_2
Red Hat · RHEL 7 enterprise_linux:7::workstation mercurial-hgk 0:2.6.2-6.el7_2

Vulnerabilities 2

  • High 8.8
    CVE-2016-3068

    Mercurial arbitrary code execution via a crafted git ext:: URL

    Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.

    mercurial mercurial mercurial Debian Ubuntu PyPI
  • High 8.8
    CVE-2016-3069

    Mercurial vulnerable to arbitrary code execution via a crafted name when converting a Git repository

    Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

    mercurial mercurial mercurial Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1319768
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1320155
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0706.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-3068
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3068
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3068
  • article
    https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.7.3_.282016-3-29.29
  • report
    https://access.redhat.com/security/cve/CVE-2016-3069
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-3069
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-3069