SB2016050209 - Slackware Linux update for mercurial

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016050209

SB2016050209 - Slackware Linux update for mercurial

Published: May 2, 2016 Updated: May 6, 2017

Security Bulletin ID SB2016050209
Severity
High
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Input validation error (CVE-ID: CVE-2015-7545)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x before 2.6.1 do not properly restrict the allowed protocols, which might allow remote attackers to execute arbitrary code via a URL in a (a) .gitmodules file or (b) unknown other sources in a submodule.


2) Improper access control (CVE-ID: CVE-2016-3105)

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.


Remediation

Install update from vendor's website.

References