emacs, mercurial security update

2017-06-2819:23:17

CentOS Project

lists.centos.org

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.03 Low

EPSS

Percentile

90.8%

JSON

CentOS Errata and Security Advisory CESA-2017:1576

Mercurial is a fast, lightweight source control management system designed for efficient handling of very large distributed projects.

Security Fix(es):

A flaw was found in the way “hg serve --stdio” command in Mercurial handled command-line options. A remote, authenticated attacker could use this flaw to execute arbitrary code on the Mercurial server by using specially crafted command-line options. (CVE-2017-9462)

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2017-June/084633.html
https://lists.centos.org/pipermail/centos-announce/2017-June/084650.html

Affected packages:
emacs-mercurial
emacs-mercurial-el
mercurial
mercurial-hgk

Upstream details at:
https://access.redhat.com/errata/RHSA-2017:1576

OSVersionArchitecturePackageVersionFilename
CentOS6i686emacs-mercurial< 1.4-5.el6_9emacs-mercurial-1.4-5.el6_9.i686.rpm
CentOS6i686emacs-mercurial-el< 1.4-5.el6_9emacs-mercurial-el-1.4-5.el6_9.i686.rpm
CentOS6i686mercurial< 1.4-5.el6_9mercurial-1.4-5.el6_9.i686.rpm
CentOS6i686mercurial-hgk< 1.4-5.el6_9mercurial-hgk-1.4-5.el6_9.i686.rpm
CentOS6x86_64emacs-mercurial< 1.4-5.el6_9emacs-mercurial-1.4-5.el6_9.x86_64.rpm
CentOS6x86_64emacs-mercurial-el< 1.4-5.el6_9emacs-mercurial-el-1.4-5.el6_9.x86_64.rpm
CentOS6x86_64mercurial< 1.4-5.el6_9mercurial-1.4-5.el6_9.x86_64.rpm
CentOS6x86_64mercurial-hgk< 1.4-5.el6_9mercurial-hgk-1.4-5.el6_9.x86_64.rpm
CentOS7x86_64emacs-mercurial< 2.6.2-7.el7_3emacs-mercurial-2.6.2-7.el7_3.x86_64.rpm
CentOS7x86_64emacs-mercurial-el< 2.6.2-7.el7_3emacs-mercurial-el-2.6.2-7.el7_3.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
CentOS	6	i686	emacs-mercurial	< 1.4-5.el6_9	emacs-mercurial-1.4-5.el6_9.i686.rpm
CentOS	6	i686	emacs-mercurial-el	< 1.4-5.el6_9	emacs-mercurial-el-1.4-5.el6_9.i686.rpm
CentOS	6	i686	mercurial	< 1.4-5.el6_9	mercurial-1.4-5.el6_9.i686.rpm
CentOS	6	i686	mercurial-hgk	< 1.4-5.el6_9	mercurial-hgk-1.4-5.el6_9.i686.rpm
CentOS	6	x86_64	emacs-mercurial	< 1.4-5.el6_9	emacs-mercurial-1.4-5.el6_9.x86_64.rpm
CentOS	6	x86_64	emacs-mercurial-el	< 1.4-5.el6_9	emacs-mercurial-el-1.4-5.el6_9.x86_64.rpm
CentOS	6	x86_64	mercurial	< 1.4-5.el6_9	mercurial-1.4-5.el6_9.x86_64.rpm
CentOS	6	x86_64	mercurial-hgk	< 1.4-5.el6_9	mercurial-hgk-1.4-5.el6_9.x86_64.rpm
CentOS	7	x86_64	emacs-mercurial	< 2.6.2-7.el7_3	emacs-mercurial-2.6.2-7.el7_3.x86_64.rpm
CentOS	7	x86_64	emacs-mercurial-el	< 2.6.2-7.el7_3	emacs-mercurial-el-2.6.2-7.el7_3.x86_64.rpm