PT-2016-5353 · Mercurial+4 · Mercurial+4

Blake Burkhart · Publicado 2016-04-05 · Atualizado 2024-06-15 · CVE-2016-3069

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 3.7.3

Description The issue allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

Recommendations For versions prior to 3.7.3, update to version 3.7.3 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2016-1729

CESA-2016_0706

CVE-2016-3069

DSA-3542-1

GHSA-8FM8-7365-5RH2

MGASA-2016-0138

OPENSUSE-SU-2016_1016-1

OPENSUSE-SU-2016_1073-1

OPENSUSE-SU-2024:10070-1

PYSEC-2016-27

RHSA-2016:0706

RHSA-2016_0706

SUSE-SU-2016:1010-1

SUSE-SU-2016:1011-1

Produtos afetados

Alt Linux

Centos

Mercurial

Red Hat

Suse

Referências · 45

• https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2016-27.yaml · Nota
• https://suse.com/security/cve/CVE-2016-3068 · Nota
• https://security-tracker.debian.org/tracker/CVE-2016-3069 · Aviso do Fabricante
• https://bugzilla.suse.com/973177 · Nota
• https://osv.dev/vulnerability/GHSA-8fm8-7365-5rh2 · Aviso do Fabricante
• https://selenic.com/repo/hg-stable/rev/cdda7b96afff · Correção
• https://bugs.mageia.org/show_bug.cgi?id=18124 · Nota
• https://security.gentoo.org/glsa/201612-19 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3069 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181505.html · Aviso do Fabricante
• https://osv.dev/vulnerability/MGASA-2016-0138 · Aviso do Fabricante
• https://selenic.com/repo/hg-stable/rev/197eed39e3d5 · Correção
• https://selenic.com/repo/hg-stable/rev/ae279d4a19e9 · Correção
• https://cve.org/CVERecord?id=CVE-2016-3069 · Nota de Segurança
• http://rhn.redhat.com/errata/RHSA-2016-0706.html · Aviso do Fabricante