mercurial - security update

Several vulnerabilities have been discovered in Mercurial, a distributed
version control system. The Common Vulnerabilities and Exposures project
identifies the following issues:

• CVE-2016-3068
  Blake Burkhart discovered that Mercurial allows URLs for Git
  subrepositories that could result in arbitrary code execution on
  clone.
• CVE-2016-3069
  Blake Burkhart discovered that Mercurial allows arbitrary code
  execution when converting Git repositories with specially
  crafted names.
• CVE-2016-3630
  It was discovered that Mercurial does not properly perform bounds-checking
  in its binary delta decoder, which may be exploitable for
  remote code execution via clone, push or pull.

For the oldstable distribution (wheezy), these problems have been fixed
in version 2.2.2-4+deb7u2.

For the stable distribution (jessie), these problems have been fixed in
version 3.1.2-2+deb8u2.

For the unstable distribution (sid), these problems have been fixed in
version 3.7.3-1.

We recommend that you upgrade your mercurial packages.