Security fix for CVE-2016-3630, CVE-2016-3068, CVE-2016-3069 and minor upgrade

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

An update for mercurial is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects.

Security Fix(es) :

* It was discovered that Mercurial failed to properly check Git sub-repository URLs. A Mercurial repository that includes a Git sub-repository with a specially crafted URL could cause Mercurial to execute arbitrary code. (CVE-2016-3068)

* It was discovered that the Mercurial convert extension failed to sanitize special characters in Git repository names. A Git repository with a specially crafted name could cause Mercurial to execute arbitrary code when the Git repository was converted to a Mercurial repository. (CVE-2016-3069)

Red Hat would like to thank Blake Burkhart for reporting these issues.

An update of [apache-tomcat,mercurial] packages for PhotonOS has been released.

为 Slackware 13.0、13.1、13.37、14.0、14.1 和当前版本提供了用于修复安全问题的新 mercurial 程序包。

mercurial 已更新，修复了三个安全问题。

修复了这些安全问题：

- CVE-2016-3069：转换 Git repos 时执行任意代码 (bsc#973176)。

- CVE-2016-3068：以 Git subrepos 执行任意代码 (bsc#973177)。

- CVE-2016-3630：二进制 delta 解码中的远程代码执行 (bsc#973175)。

CVE-2016-3630、CVE-2016-3068、CVE-2016-3069 与次要升级的安全补丁

请注意，Tenable Network Security 已直接从 Fedora 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下尽可能进行了自动整理和排版。

mercurial 的更新现在可用于 Red Hat Enterprise Linux 7。

Red Hat 产品安全团队将此更新评级为具有重要安全影响。可从“参考”部分中的 CVE 链接获取通用漏洞评分系统 (CVSS) 基本分数，其针对每个漏洞给出了详细的严重性等级。

Mercurial 是一个快速、轻量级的源控制管理系统，专用于处理非常大的分布式项目。

安全补丁：

* 已发现 Mercurial 无法正确检查 Git 子存储库 URL。内含 Git 子存储库及特别构建的 URL 的 Mercurial 存储库可造成 Mercurial 执行任意代码。(CVE-2016-3068)

* 已发现 Mercurial 转换扩展无法审查 Git 存储库名称中的特殊字符。将 Git 存储库转换为 Mercurial 存储库时，具有特别构建的名称的 Git 存储库可造成 Mercurial 执行任意代码。(CVE-2016-3069)

Red Hat 在此感谢 Blake Burkhart 报告这些问题。

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
90414	Fedora 22 : mercurial-3.5.2-1.fc22 (2016-79604dde9f)	Nessus	Fedora Local Security Checks	2016/4/8	2021/1/11	high
90851	RHEL 7 : mercurial (RHSA-2016:0706)	Nessus	Red Hat Local Security Checks	2016/5/3	2019/10/24	high
90837	CentOS 7 : mercurial (CESA-2016:0706)	Nessus	CentOS Local Security Checks	2016/5/3	2021/1/4	high
111845	Photon OS 1.0: Apache / Mercurial PHSA-2016-0011 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	high
90319	Slackware 13.0 / 13.1 / 13.37 / 14.0 / 14.1 / 当前版本：mercurial (SSA:2016-092-01)	Nessus	Slackware Local Security Checks	2016/4/5	2021/1/14	high
90559	openSUSE 安全更新：mercurial (openSUSE-2016-467)	Nessus	SuSE Local Security Checks	2016/4/18	2021/1/19	high
90414	Fedora 22：mercurial-3.5.2-1.fc22 (2016-79604dde9f)	Nessus	Fedora Local Security Checks	2016/4/8	2021/1/11	high
90837	CentOS 7：mercurial (CESA-2016:0706)	Nessus	CentOS Local Security Checks	2016/5/3	2021/1/4	high
90851	RHEL 7：mercurial (RHSA-2016:0706)	Nessus	Red Hat Local Security Checks	2016/5/3	2019/10/24	high

检测

插件搜索

high

high

high

high

high

high

high

high

high