Summary
USN-5102-1 fixed vulnerabilities in Mercurial. This update provides the
corresponding updates for Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.
Original advisory details:
It was discovered that Mercurial mishandled symlinks in subrepositories. An
attacker could use this issue to write arbitrary files to the
target’s filesystem. (CVE-2019-3902)
It was discovered that Mercurial incorrectly handled certain manifest files.
An attacker could use this issue to cause a denial of service and possibly
execute arbitrary code. This issue only affected Ubuntu 16.04 ESM. (CVE-2018-17983)
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | mercurial | 2.8.2-1ubuntu1.4+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | mercurial | 3.7.3-1ubuntu1.2+esm2 |
Vulnerabilities 2
-
Critical 9.1
Mercurial Out-of-bounds Read vulnerability
cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.
-
Medium 5.1
Mercurial Path Traversal/Link Following vulnerability
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.