CVE-2016-3069

Published: Apr 13, 2016Modified: May 6, 2026

8.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Affected (18)

Products: Mercurial: Mercurial · Debian: Debian Linux · Opensuse: Opensuse, Leap · +3 more

Show all products

1 product

1 product

2 products

2 products

Linux Enterprise Debuginfo

Linux Enterprise Software Development Kit

1 product

7 products

Enterprise Linux Desktop

Enterprise Linux Hpc Node

Enterprise Linux Hpc Node Eus

Enterprise Linux Server

Enterprise Linux Server Aus

Enterprise Linux Server Eus

Enterprise Linux Workstation

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Mercurial Mercurial	Up to 3.7.2

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 7.0
Debian Debian Linux	Version 8.0

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	Version 13.2
Suse Linux Enterprise Debuginfo	Version 11 sp4
Suse Linux Enterprise Software Development Kit	Version 11 sp4
Suse Linux Enterprise Software Development Kit	Version 12
Suse Linux Enterprise Software Development Kit	Version 12 sp1

Configuration D

1 vulnerable

Vulnerable Software	Affected Versions
Opensuse Leap	Version 42.1

Configuration E

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 22
Fedoraproject Fedora	Version 23

Configuration F

7 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux Desktop	Version 7.0
Redhat Enterprise Linux Hpc Node	Version 7.0
Redhat Enterprise Linux Hpc Node Eus	Version 7.2
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Server Aus	Version 7.2
Redhat Enterprise Linux Server Eus	Version 7.2
Redhat Enterprise Linux Workstation	Version 7.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (34)

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181505.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181542.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00016.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00017.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00018.html

Source: secalert@redhat.com

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00043.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0706.html

Source: secalert@redhat.com

Third Party Advisory

http://www.debian.org/security/2016/dsa-3542

Source: secalert@redhat.com

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: secalert@redhat.com

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: secalert@redhat.com

https://security.gentoo.org/glsa/201612-19

Source: secalert@redhat.com

https://selenic.com/repo/hg-stable/rev/197eed39e3d5

Source: secalert@redhat.com

Issue TrackingPatch

https://selenic.com/repo/hg-stable/rev/80cac1de6aea

Source: secalert@redhat.com

Issue TrackingPatch

https://selenic.com/repo/hg-stable/rev/ae279d4a19e9

Source: secalert@redhat.com

Issue TrackingPatch

https://selenic.com/repo/hg-stable/rev/b732e7f2aba4

Source: secalert@redhat.com

Issue TrackingPatch

https://selenic.com/repo/hg-stable/rev/cdda7b96afff

Source: secalert@redhat.com

Issue TrackingPatch

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.7.3_.282016-3-29.29

Source: secalert@redhat.com

Vendor Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181505.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181542.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00016.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00017.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00018.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00043.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-0706.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.debian.org/security/2016/dsa-3542

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/201612-19

Source: af854a3a-2127-422b-91ae-364da2661108

https://selenic.com/repo/hg-stable/rev/197eed39e3d5

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://selenic.com/repo/hg-stable/rev/80cac1de6aea

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://selenic.com/repo/hg-stable/rev/ae279d4a19e9

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://selenic.com/repo/hg-stable/rev/b732e7f2aba4

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://selenic.com/repo/hg-stable/rev/cdda7b96afff

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatch

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.7.3_.282016-3-29.29

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.