mercurial 已更新，修复了三个安全问题。

修复了这些安全问题：

- CVE-2016-3069：转换 Git repos 时执行任意代码 (bsc#973176)。

- CVE-2016-3068：以 Git subrepos 执行任意代码 (bsc#973177)。

- CVE-2016-3630：二进制 delta 解码中的远程代码执行 (bsc#973175)。

mercurial 的更新现在可用于 Red Hat Enterprise Linux 7。

Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。

Mercurial 是一个快速、轻量级的源控制管理系统，专用于处理非常大的分布式项目。

安全补丁：

* 已发现 Mercurial 无法正确检查 Git 子存储库 URL。内含 Git 子存储库及特别构建的 URL 的 Mercurial 存储库可造成 Mercurial 执行任意代码。(CVE-2016-3068)

* 已发现 Mercurial 转换扩展无法审查 Git 存储库名称中的特殊字符。将 Git 存储库转换为 Mercurial 存储库时，具有特别构建的名称的 Git 存储库可造成 Mercurial 执行任意代码。(CVE-2016-3069)

Red Hat 在此感谢 Blake Burkhart 报告这些问题。

Security fix for CVE-2016-3630, CVE-2016-3068, CVE-2016-3069 and minor upgrade

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

New mercurial packages are available for Slackware 13.0, 13.1, 13.37, 14.0, 14.1, and -current to fix security issues.

mercurial was updated to fix three security issues.

These security issues were fixed :

  - CVE-2016-3069: Arbitrary code execution when converting     Git repos (bsc#973176).

  - CVE-2016-3068: Arbitrary code execution with Git     subrepos (bsc#973177).

  - CVE-2016-3630: Remote code execution in binary delta     decoding (bsc#973175).

An update for mercurial is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects.

Security Fix(es) :

* It was discovered that Mercurial failed to properly check Git sub-repository URLs. A Mercurial repository that includes a Git sub-repository with a specially crafted URL could cause Mercurial to execute arbitrary code. (CVE-2016-3068)

* It was discovered that the Mercurial convert extension failed to sanitize special characters in Git repository names. A Git repository with a specially crafted name could cause Mercurial to execute arbitrary code when the Git repository was converted to a Mercurial repository. (CVE-2016-3069)

Red Hat would like to thank Blake Burkhart for reporting these issues.

An update of [apache-tomcat,mercurial] packages for PhotonOS has been released.

An update of the mercurial package has been released.

ID	名稱	產品	系列	已發布	已更新	嚴重性
90559	openSUSE 安全更新：mercurial (openSUSE-2016-467)	Nessus	SuSE Local Security Checks	2016/4/18	2021/1/19	high
90837	CentOS 7：mercurial (CESA-2016:0706)	Nessus	CentOS Local Security Checks	2016/5/3	2021/1/4	high
90414	Fedora 22 : mercurial-3.5.2-1.fc22 (2016-79604dde9f)	Nessus	Fedora Local Security Checks	2016/4/8	2021/1/11	high
90319	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / current : mercurial (SSA:2016-092-01)	Nessus	Slackware Local Security Checks	2016/4/5	2021/1/14	high
90559	openSUSE Security Update : mercurial (openSUSE-2016-467)	Nessus	SuSE Local Security Checks	2016/4/18	2021/1/19	high
90837	CentOS 7 : mercurial (CESA-2016:0706)	Nessus	CentOS Local Security Checks	2016/5/3	2021/1/4	high
90851	RHEL 7 : mercurial (RHSA-2016:0706)	Nessus	Red Hat Local Security Checks	2016/5/3	2019/10/24	high
111845	Photon OS 1.0: Apache / Mercurial PHSA-2016-0011 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	high
121646	Photon OS 1.0: Mercurial PHSA-2016-0011	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/23	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high

high

high