mercurial: code execution
| Package(s): | mercurial |
CVE #(s): | CVE-2016-3105
|
| Created: | May 3, 2016 |
Updated: | May 18, 2016 |
| Description: |
From the Slackware advisory:
This update fixes possible arbitrary code execution when converting Git
repos. Mercurial prior to 3.8 allowed arbitrary code execution when using
the convert extension on Git repos with hostile names. This could affect
automated code conversion services that allow arbitrary repository names.
This is a further side-effect of Git CVE-2015-7545.
Reported and fixed by Blake Burkhart. |
| Alerts: |
|
