CVE-2016-3068
Mercurial arbitrary code execution via a crafted git ext:: URL
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
- Record
CVE-2016-3068- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
- Record
CVE-2016-3068- Updated
- 2026-11-02
EUVDEUVD-2016-0014 No score
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
- Record
EUVD-2016-0014- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-j7c2-rqm3-c97m
Mercurial arbitrary code execution via a crafted git ext:: URL
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
- Record
GHSA-j7c2-rqm3-c97m- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
- Record
CVE-2016-3068- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-3068
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
- Record
DEBIAN-CVE-2016-3068- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-j7c2-rqm3-c97m
Mercurial arbitrary code execution via a crafted git ext:: URL
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
- Record
GHSA-j7c2-rqm3-c97m- CVSS 4.0
- 8.7 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-3068
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
- Record
UBUNTU-CVE-2016-3068- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2016-0138 No score
Updated mercurial packages fix security vulnerabilities
Updated mercurial packages fix security vulnerabilities:
Blake Burkhart discovered that Mercurial allows URLs for Git subrepositories that could result in arbitrary code execution on clone (CVE-2016-3068).
Blake Burkhart discovered that Mercurial allows arbitrary code execution when converting Git repositories with specially crafted names (CVE-2016-3069).
It was discovered that Mercurial does not properly perform bounds-checking in its binary delta decoder, which may be exploitable for remote code execution via clone, push or pull (CVE-2016-3630).
- Record
MGASA-2016-0138- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10070-1 No score
mercurial-4.0-1.1 on GA media
These are all security issues fixed in the mercurial-4.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10070-1- Updated
- 2026-11-02
OSVPYSEC-2016-26 No score
Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.
- Record
PYSEC-2016-26- Updated
- 2026-11-02
OSVSUSE-SU-2016:1010-1 No score
Security update for mercurial
mercurial was updated to fix three security issues.
These security issues were fixed:
- CVE-2016-3069: Arbitrary code execution when converting Git repos (bsc#973176).
- CVE-2016-3068: Arbitrary code execution with Git subrepos (bsc#973177).
- CVE-2016-3630: Remote code execution in binary delta decoding (bsc#973175).
- Record
SUSE-SU-2016:1010-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1011-1 No score
Security update for mercurial
mercurial was updated to fix three security issues.
These security issues were fixed:
- CVE-2016-3069: Arbitrary code execution when converting Git repos (bsc#973176).
- CVE-2016-3068: Arbitrary code execution with Git subrepos (bsc#973177).
- CVE-2016-3630: Remote code execution in binary delta decoding (bsc#973175).
- Record
SUSE-SU-2016:1011-1- Updated
- 2026-11-02
Affected products
- mercurial
- debian linux
- fedoraproject fedora
- opensuse leap
- opensuse
- redhat enterprise linux desktop
- redhat enterprise linux hpc node
- redhat enterprise linux hpc node eus
- redhat enterprise linux server
- redhat enterprise linux server aus
- redhat enterprise linux server eus
- redhat enterprise linux workstation
Show 2 moreShow less
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mercurialPyPI |
before 3.7.3 | 3.7.3 |
mercurialDebian:12 |
before 3.7.3-1 | 3.7.3-1 |
mercurialDebian:13 |
before 3.7.3-1 | 3.7.3-1 |
mercurialDebian:14 |
before 3.7.3-1 | 3.7.3-1 |
mercurialDebian:7 |
before 2.2.2-4+deb7u2, plus listed versions 2.2.2-32.2.2-42.2.2-4+deb7u1 |
2.2.2-4+deb7u2 |
mercurialDebian:8 |
before 3.1.2-2+deb8u2, plus listed versions 3.1.2-23.1.2-2+deb8u1 |
3.1.2-2+deb8u2 |
mercurialPyPI |
before 3.7.3, plus listed versions 0.8.10.90.9.10.9.20.9.3 Show 45 moreShow less0.9.40.9.51.01.0.11.0.21.11.1.11.1.21.21.2.11.31.3.11.41.4.11.4.21.4.31.51.5.11.5.21.5.31.5.41.61.6.11.6.21.6.31.6.41.71.7.11.7.21.7.31.7.51.81.8.11.8.21.8.31.8.41.91.9.11.9.21.9.32.02.0.12.0.22.12.1.1 |
3.7.3 |
mercurialMageia:5 |
before 3.1.1-5.1.mga5 | 3.1.1-5.1.mga5 |
emacs-mercurialRed Hat:enterprise_linux:7::client |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
emacs-mercurial-elRed Hat:enterprise_linux:7::client |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
Show 23 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mercurialRed Hat:enterprise_linux:7::client |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurial-debuginfoRed Hat:enterprise_linux:7::client |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurial-hgkRed Hat:enterprise_linux:7::client |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
emacs-mercurialRed Hat:enterprise_linux:7::computenode |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
emacs-mercurial-elRed Hat:enterprise_linux:7::computenode |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurialRed Hat:enterprise_linux:7::computenode |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurial-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurial-hgkRed Hat:enterprise_linux:7::computenode |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurialRed Hat:enterprise_linux:7::server |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurial-debuginfoRed Hat:enterprise_linux:7::server |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
emacs-mercurialRed Hat:enterprise_linux:7::server |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
emacs-mercurial-elRed Hat:enterprise_linux:7::server |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurial-hgkRed Hat:enterprise_linux:7::server |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurialRed Hat:enterprise_linux:7::workstation |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurial-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
emacs-mercurialRed Hat:enterprise_linux:7::workstation |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
emacs-mercurial-elRed Hat:enterprise_linux:7::workstation |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurial-hgkRed Hat:enterprise_linux:7::workstation |
before 0:2.6.2-6.el7_2 | 0:2.6.2-6.el7_2 |
mercurialSUSE:Linux Enterprise Software Development Kit 12 |
before 2.8.2-6.1 | 2.8.2-6.1 |
mercurialSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 2.8.2-6.1 | 2.8.2-6.1 |
mercurialSUSE:Linux Enterprise Software Development Kit 11 SP4 |
before 2.3.2-0.11.1 | 2.3.2-0.11.1 |
mercurialUbuntu:14.04:LTS |
before 2.8.2-1ubuntu1.4, plus listed versions 2.6.3-12.7.2-12.8.1-22.8.2-1ubuntu12.8.2-1ubuntu1.3 |
2.8.2-1ubuntu1.4 |
mercurialopenSUSE:Tumbleweed |
before 4.0-1.1 | 4.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-3068 is a high vulnerability (CVSS 8.8) in Mercurial, published April 5, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.41%, the 92nd percentile. Fixed in mercurial 3.7.3.
References
lists.fedoraproject.org/pipermail/package-announce/2016-April/181505.html
security.gentoo.org/glsa/201612-19
debian.org/security/2016/dsa-3542
selenic.com/repo/hg-stable/rev/34d43cb85de8
oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
lists.opensuse.org/opensuse-security-announce/2016-04/msg00018.html
Show 36 moreShow less
rhn.redhat.com/errata/RHSA-2016-0706.html
mercurial-scm.org/wiki/WhatsNew
securityfocus.com/bid/85733
nvd.nist.gov/vuln/detail/CVE-2016-3068
web.archive.org/web/20200228003737/http://www.securityfocus.com/bid/85733
github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2016-26.yaml
security-tracker.debian.org/tracker/CVE-2016-3068
advisories.mageia.org/MGASA-2016-0138.html
bugs.mageia.org/show_bug.cgi?id=18124
access.redhat.com/errata/RHSA-2016:0706
bugzilla.redhat.com/show_bug.cgi?id=1319768
security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0706.json
cve.org/CVERecord?id=CVE-2016-3068
suse.com/support/update/announcement/2016/suse-su-20161010-1
bugzilla.suse.com/973175
ubuntu.com/security/CVE-2016-3068
Left out here: 52 versions. The JSON record has them.