{"id":"CVE-2016-3069","aliases":["DEBIAN-CVE-2016-3069","DSA-3542-1","EUVD-2016-0015","GHSA-8fm8-7365-5rh2","MGASA-2016-0138","PYSEC-2016-27","RHSA-2016:0706","SUSE-SU-2016:1010-1","SUSE-SU-2016:1011-1","UBUNTU-CVE-2016-3069","openSUSE-SU-2024:10070-1"],"status":"published","title":"Mercurial vulnerable to arbitrary code execution via a crafted name when converting a Git repository","description":"Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04953,"percentile":0.92229,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2016-04-05T00:00:00Z","modified":"2026-09-22T07:02:58Z","fixes":[{"ecosystem":"PyPI","package":"mercurial","fixed_in":["3.7.3"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"mercurial","fixed_in":["3.7.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mercurial","fixed_in":["3.7.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mercurial","fixed_in":["3.7.3-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"mercurial","fixed_in":["2.8.2-1ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-4+deb7u2"}]}],"versions":["2.2.2-3","2.2.2-4","2.2.2-4+deb7u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:8","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2+deb8u2"}]}],"versions":["3.1.2-2","3.1.2-2+deb8u1"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3"}]}],"versions":["0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.3","1.7.5","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","2.2.2","2.3","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.7.2","2.8","2.8.1","2.8.2","2.9","2.9.1","3.0","3.0.1","3.1","3.1.1","3.1.2","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.3","3.3-rc","3.3.1","3.3.2","3.3.3","3.4","3.4-rc","3.4.1","3.4.2","3.5","3.5-rc","3.5.1","3.5.2","3.6","3.6-rc","3.6.1","3.6.2","3.6.3","3.7","3.7-rc","3.7.1","3.7.2"]},{"source":"osv","ecosystem":"Mageia:5","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-5.1.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3"}]}],"versions":["0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.3","1.7.5","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","2.2.2","2.3","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.7.2","2.8","2.8.1","2.8.2","2.9","2.9.1","3.0","3.0.1","3.1","3.1.1","3.1.2","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.3","3.3-rc","3.3.1","3.3.2","3.3.3","3.4","3.4-rc","3.4.1","3.4.2","3.5","3.5-rc","3.5.1","3.5.2","3.6","3.6-rc","3.6.1","3.6.2","3.6.3","3.7","3.7-rc","3.7.1","3.7.2"]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"emacs-mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"emacs-mercurial-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mercurial-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mercurial-hgk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"emacs-mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"emacs-mercurial-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mercurial-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mercurial-hgk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mercurial-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"emacs-mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"emacs-mercurial-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mercurial-hgk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mercurial-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"emacs-mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"emacs-mercurial-el","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mercurial-hgk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.6.2-6.el7_2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-6.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-0.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1ubuntu1.4"}]}],"versions":["2.6.3-1","2.7.2-1","2.8.1-2","2.8.2-1ubuntu1","2.8.2-1ubuntu1.3"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-1.1"}]}],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mercurial","product":"mercurial"},{"vendor":"opensuse","product":"leap"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_hpc_node"},{"vendor":"redhat","product":"enterprise_linux_hpc_node_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"suse","product":"linux_enterprise_debuginfo"},{"vendor":"suse","product":"linux_enterprise_software_development_kit"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181505.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/201612-19","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"http://www.debian.org/security/2016/dsa-3542","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://selenic.com/repo/hg-stable/rev/b732e7f2aba4","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://selenic.com/repo/hg-stable/rev/197eed39e3d5","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00018.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://selenic.com/repo/hg-stable/rev/cdda7b96afff","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"http://rhn.redhat.com/errata/RHSA-2016-0706.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.7.3_.282016-3-29.29","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web","article","report"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinapr2016-2952098.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://selenic.com/repo/hg-stable/rev/80cac1de6aea","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00017.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00016.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181542.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://selenic.com/repo/hg-stable/rev/ae279d4a19e9","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","web","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00043.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3069","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2016-27.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8fm8-7365-5rh2","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-3069","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0138.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18124","tags":["report"]},{"url":"https://www.debian.org/security/2016/dsa-3542","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0706","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1319768","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1320155","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0706.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3068","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3068","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3069","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3069","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161010-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/973175","tags":["report"]},{"url":"https://bugzilla.suse.com/973176","tags":["report"]},{"url":"https://bugzilla.suse.com/973177","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3630","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161011-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-3069","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3105","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-3069","description":"Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.","status":"published","published":"2016-04-13T16:00:00Z","modified":"2024-08-05T23:40:15.576Z","updated_at":"2026-11-02T14:33:34.094161Z"}],"euvd":[{"id":"EUVD-2016-0015","description":"Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.","status":"published","published":"2016-04-13T16:00:00Z","modified":"2024-08-05T23:40:15Z","updated_at":"2026-11-03T02:22:51.669902Z"}],"ghsa":[{"id":"GHSA-8fm8-7365-5rh2","title":"Mercurial vulnerable to arbitrary code execution via a crafted name when converting a Git repository","description":"Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.","status":"published","published":"2022-05-14T02:08:52Z","modified":"2024-09-24T20:42:48Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:06.29677Z"}],"nvd":[{"id":"CVE-2016-3069","description":"Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.","status":"published","published":"2016-04-13T16:59:17.227Z","modified":"2026-06-17T00:44:54.6Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:23.795791Z"}],"osv":[{"id":"CVE-2016-3069","description":"Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.","status":"published","published":"2016-04-13T16:59:17.227Z","modified":"2026-04-16T06:16:39.924413126Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-3069","description":"Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.","status":"published","published":"2016-04-13T16:59:17.227Z","modified":"2026-09-22T07:02:58.13266297Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-8fm8-7365-5rh2","title":"Mercurial vulnerable to arbitrary code execution via a crafted name when converting a Git repository","description":"Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.","status":"published","published":"2022-05-14T02:08:52Z","modified":"2024-09-24T20:47:29.627902Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:42.437513Z"},{"id":"UBUNTU-CVE-2016-3069","description":"Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.","status":"published","published":"2016-04-13T16:59:00Z","modified":"2025-09-08T16:43:40Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"DSA-3542-1","title":"mercurial - security update","status":"published","published":"2016-04-05T00:00:00Z","modified":"2026-03-09T01:21:06.578983Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0138","title":"Updated mercurial packages fix security vulnerabilities","description":"Updated mercurial packages fix security vulnerabilities:\n\nBlake Burkhart discovered that Mercurial allows URLs for Git subrepositories\nthat could result in arbitrary code execution on clone (CVE-2016-3068).\n\nBlake Burkhart discovered that Mercurial allows arbitrary code execution when\nconverting Git repositories with specially crafted names (CVE-2016-3069).\n\nIt was discovered that Mercurial does not properly perform bounds-checking in\nits binary delta decoder, which may be exploitable for remote code execution\nvia clone, push or pull (CVE-2016-3630).\n","status":"published","published":"2016-04-13T17:39:04Z","modified":"2026-04-16T06:23:04.831988188Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10070-1","title":"mercurial-4.0-1.1 on GA media","description":"These are all security issues fixed in the mercurial-4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:54:02.990519Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"PYSEC-2016-27","description":"Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.","status":"published","published":"2016-04-13T16:59:00Z","modified":"2026-06-10T17:02:10.141924619Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"RHSA-2016:0706","title":"Red Hat Security Advisory: mercurial security update","status":"published","published":"2024-09-15T23:22:50Z","modified":"2026-06-26T12:21:51.470665792Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2016:1010-1","title":"Security update for mercurial","description":"mercurial was updated to fix three security issues.\n\nThese security issues were fixed:\n- CVE-2016-3069: Arbitrary code execution when converting Git repos (bsc#973176).\n- CVE-2016-3068: Arbitrary code execution with Git subrepos (bsc#973177).\n- CVE-2016-3630: Remote code execution in binary delta decoding (bsc#973175).\n  ","status":"published","published":"2016-04-12T08:38:59Z","modified":"2026-02-04T04:36:22.169758Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1011-1","title":"Security update for mercurial","description":"mercurial was updated to fix three security issues.\n\nThese security issues were fixed:\n- CVE-2016-3069: Arbitrary code execution when converting Git repos (bsc#973176).\n- CVE-2016-3068: Arbitrary code execution with Git subrepos (bsc#973177).\n- CVE-2016-3630: Remote code execution in binary delta decoding (bsc#973175).\n  ","status":"published","published":"2016-04-12T08:39:57Z","modified":"2026-02-04T02:30:12.293658Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}