PT-2016-5627 · Mercurial+2 · Mercurial+2

Publicado 2016-04-05 · Atualizado 2024-06-15 · CVE-2016-3630

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 3.7.3

Description The issue allows remote attackers to execute arbitrary code via certain commands, related to a list sizing rounding error and short records. This can be achieved through a clone, push, or pull command.

Recommendations For versions prior to 3.7.3, update to version 3.7.3 or later to resolve the issue.

Correção

RCE

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

ALT-PU-2016-1729

CVE-2016-3630

DSA-3542-1

GHSA-9VJF-JJCQ-3GH7

MGASA-2016-0138

OPENSUSE-SU-2016_1016-1

OPENSUSE-SU-2016_1073-1

OPENSUSE-SU-2024:10070-1

PYSEC-2016-29

SUSE-SU-2016:1010-1

SUSE-SU-2016:1011-1

Produtos afetados

Alt Linux

Mercurial

Suse

Referências · 40

• https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2016-29.yaml · Nota
• https://suse.com/security/cve/CVE-2016-3068 · Nota
• https://selenic.com/repo/hg-stable/rev/b9714d958e89 · Nota
• https://osv.dev/vulnerability/CVE-2016-3630 · Aviso do Fabricante
• https://bugzilla.suse.com/973177 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00018.html · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2016-29 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-3542-1 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181542.html · Aviso do Fabricante
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00016.html · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2016-3630 · Aviso do Fabricante
• https://bugs.mageia.org/show_bug.cgi?id=18124 · Nota
• https://security.gentoo.org/glsa/201612-19 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-3630 · Aviso do Fabricante
• http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181505.html · Aviso do Fabricante