{"id":"CVE-2016-3105","aliases":["DEBIAN-CVE-2016-3105","DLA-459-1","DSA-3570-1","EUVD-2016-0016","GHSA-49cw-434h-qc57","MGASA-2016-0172","PYSEC-2016-28","SUSE-SU-2016:1442-1","SUSE-SU-2016:1443-1","UBUNTU-CVE-2016-3105","openSUSE-SU-2024:10070-1"],"status":"published","title":"Mercurial vulnerable to arbitrary code execution when converting Git repos","description":"The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02751,"percentile":0.86309,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2016-05-05T00:00:00Z","modified":"2026-09-22T07:02:59Z","fixes":[{"ecosystem":"PyPI","package":"mercurial","fixed_in":["3.8","3.8-rc"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"mercurial","fixed_in":["3.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mercurial","fixed_in":["3.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mercurial","fixed_in":["3.8.1-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"mercurial","fixed_in":["2.2.2-4+deb7u3"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"mercurial","fixed_in":["3.1.2-2+deb8u3"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"mercurial","fixed_in":["3.1.1-5.2.mga5"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"mercurial","fixed_in":["2.8.2-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"mercurial","fixed_in":["2.8.2-9.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"mercurial","fixed_in":["2.3.2-0.14.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"mercurial","fixed_in":["2.8.2-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"mercurial","fixed_in":["3.7.3-1ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8.1-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-4+deb7u3"}]}],"versions":["2.2.2-3","2.2.2-4","2.2.2-4+deb7u1","2.2.2-4+deb7u2"]},{"source":"osv","ecosystem":"Debian:8","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2+deb8u3"}]}],"versions":["3.1.2-2","3.1.2-2+deb8u1","3.1.2-2+deb8u2"]},{"source":"osv","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8"}]}],"versions":["0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.3","1.7.5","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","2.2.2","2.3","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.7.2","2.8","2.8.1","2.8.2","2.9","2.9.1","3.0","3.0.1","3.1","3.1.1","3.1.2","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.3","3.3-rc","3.3.1","3.3.2","3.3.3","3.4","3.4-rc","3.4.1","3.4.2","3.5","3.5-rc","3.5.1","3.5.2","3.6","3.6-rc","3.6.1","3.6.2","3.6.3","3.7","3.7-rc","3.7.1","3.7.2","3.7.3","3.8-rc"]},{"source":"osv","ecosystem":"Mageia:5","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1-5.2.mga5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.8-rc"}]}],"versions":["0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.3","1.7.5","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","2.2.2","2.3","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.7.2","2.8","2.8.1","2.8.2","2.9","2.9.1","3.0","3.0.1","3.1","3.1.1","3.1.2","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.3","3.3-rc","3.3.1","3.3.2","3.3.3","3.4","3.4-rc","3.4.1","3.4.2","3.5","3.5-rc","3.5.1","3.5.2","3.6","3.6-rc","3.6.1","3.6.2","3.6.3","3.7","3.7-rc","3.7.1","3.7.2","3.7.3"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP1","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-0.14.2"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1ubuntu1.4"}]}],"versions":["2.6.3-1","2.7.2-1","2.8.1-2","2.8.2-1ubuntu1","2.8.2-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1ubuntu1.1"}]}],"versions":["3.4-1ubuntu2","3.6.2-1ubuntu2","3.7.3-1ubuntu1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-1.1"}]}],"bundled":5}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"mercurial","product":"mercurial"}],"references":[{"url":"https://security.gentoo.org/glsa/201612-19","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/90536","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://selenic.com/hg/rev/a56296f55a5e","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2016-05/msg00082.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2016\u0026m=slackware-security.533255","tags":["vendor-advisory","x_refsource_SLACKWARE","x_transferred","web"]},{"url":"https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_3.8_.2F_3.8.1_.282016-5-1.29","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"http://www.debian.org/security/2016/dsa-3570","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-3105","tags":["advisory"]},{"url":"https://web.archive.org/web/20200228012056/http://www.securityfocus.com/bid/90536","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2016-28.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-49cw-434h-qc57","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-3105","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2016-0172.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=18363","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-3105","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161442-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/978391","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3105","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161443-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2016-3105","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-3105","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7545","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3069","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3630","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-3105","description":"The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.","status":"published","published":"2016-05-09T20:00:00Z","modified":"2024-08-05T23:47:56.955Z","updated_at":"2026-11-02T14:33:33.758954Z"}],"euvd":[{"id":"EUVD-2016-0016","description":"The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.","status":"published","published":"2016-05-09T20:00:00Z","modified":"2024-08-05T23:47:56Z","updated_at":"2026-11-03T02:22:51.132305Z"}],"ghsa":[{"id":"GHSA-49cw-434h-qc57","title":"Mercurial vulnerable to arbitrary code execution when converting Git repos","description":"The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.","status":"published","published":"2022-05-17T02:37:31Z","modified":"2024-09-30T20:45:26Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:38:07.852618Z"}],"nvd":[{"id":"CVE-2016-3105","description":"The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.","status":"published","published":"2016-05-09T20:59:03.837Z","modified":"2026-06-17T00:44:58.767Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:25.366449Z"}],"osv":[{"id":"CVE-2016-3105","description":"The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.","status":"published","published":"2016-05-09T20:59:03.837Z","modified":"2026-04-16T06:20:59.309366446Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-3105","description":"The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.","status":"published","published":"2016-05-09T20:59:03.837Z","modified":"2026-09-22T07:02:59.040339192Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:27.627285Z"},{"id":"GHSA-49cw-434h-qc57","title":"Mercurial vulnerable to arbitrary code execution when converting Git repos","description":"The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.","status":"published","published":"2022-05-17T02:37:31Z","modified":"2024-09-30T21:01:05.136792Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"UBUNTU-CVE-2016-3105","description":"The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.","status":"published","published":"2016-05-09T20:59:00Z","modified":"2025-09-08T16:43:40Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:11.872222Z"},{"id":"DLA-459-1","title":"mercurial - security update","status":"published","published":"2016-05-06T00:00:00Z","modified":"2026-03-09T02:09:18.590008Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3570-1","title":"mercurial - security update","status":"published","published":"2016-05-05T00:00:00Z","modified":"2026-03-09T01:19:38.711316Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2016-0172","title":"Updated mercurial packages fix security vulnerability","description":"This update fixes possible arbitrary code execution when converting Git\nrepos. Mercurial prior to 3.8 allowed arbitrary code execution when using\nthe convert extension on Git repos with hostile names. This could affect\nautomated code conversion services that allow arbitrary repository names.\nThis is a further side-effect of Git CVE-2015-7545. Reported and fixed by\nBlake Burkhart.\n","status":"published","published":"2016-05-12T20:00:19Z","modified":"2026-04-16T06:24:23.955906921Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"openSUSE-SU-2024:10070-1","title":"mercurial-4.0-1.1 on GA media","description":"These are all security issues fixed in the mercurial-4.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:54:02.990519Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"PYSEC-2016-28","description":"The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.","status":"published","published":"2016-05-09T20:59:00Z","modified":"2026-06-10T17:01:49.110424305Z","updated_at":"2026-11-02T15:52:51.645172Z"},{"id":"SUSE-SU-2016:1442-1","title":"Security update for mercurial","description":"\nThis update for mercurial fixes the following issues: \n\nSecurity issues fixed:\n- CVE-2016-3105: Versionsprior to 3.8 allowed arbitrary code execution\n  when using the convert extension on Git repo. (bsc#978391)","status":"published","published":"2016-05-30T13:31:38Z","modified":"2026-02-04T02:54:01.703278Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1443-1","title":"Security update for mercurial","description":"\nThis update for mercurial fixes the following issues: \n\nSecurity issues fixed:\n- CVE-2016-3105: Versionsprior to 3.8 allowed arbitrary code execution\n  when using the convert extension on Git repo. (bsc#978391)","status":"published","published":"2016-05-30T13:31:17Z","modified":"2026-02-04T03:10:59.38475Z","updated_at":"2026-11-02T15:53:43.438985Z"}]}}