MGASA-2016-0172

See a problem?
Please try reporting it to the source first.

Source

https://advisories.mageia.org/MGASA-2016-0172.html

Import Source

https://advisories.mageia.org/MGASA-2016-0172.json

JSON Data

https://api.osv.dev/v1/vulns/MGASA-2016-0172

Related

CVE-2016-3105

Published

2016-05-12T20:00:19Z

Modified

2016-05-12T19:54:25Z

Summary

Updated mercurial packages fix security vulnerability

Details

This update fixes possible arbitrary code execution when converting Git repos. Mercurial prior to 3.8 allowed arbitrary code execution when using the convert extension on Git repos with hostile names. This could affect automated code conversion services that allow arbitrary repository names. This is a further side-effect of Git CVE-2015-7545. Reported and fixed by Blake Burkhart.

References

Credits

- Mageia - COORDINATOR
- - https://wiki.mageia.org/en/Packages_Security_Team

Affected packages

Mageia:5 / mercurial

Package

Name: mercurial
Purl: pkg:rpm/mageia/mercurial?distro=mageia-5

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.1.1-5.2.mga5

Ecosystem specific

{
    "section": "core"
}