DLA-4094-1 mercurial - security update

Bulletin has no description...

CVE-2025-2361

CVE-2025-2361 affects Mercurial SCM’s Web Interface (hgweb). A cross-site scripting vulnerability arises from improper sanitization of user-controlled input passed via the cmd parameter in the Web Interface, enabling remote exploitation. Affected is Mercurial 4.5.3/71.19.145.211 with hgweb; multi...

Linux Distros Unpatched Vulnerability : CVE-2016-3069

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository. CVE-2016-3069 Note that Nessus...

GHSA-HVR9-WR9P-GRGR Mercurial missing symlink check

Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository...

The vulnerabilities of many functions in the Mercurial/subrepo.py version control tool allow attackers to compromise data integrity and cause service failures.

The vulnerability of several functions in the Mercurial version control software’s subrepo.py module is related to an incorrect definition of the reference before accessing a file. Exploiting this vulnerability could allow a remote attacker to compromise data integrity and also cause service...

CVE-2018-17983

cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry...

CVE-2018-13347

mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002...

DLA-1331-1 mercurial - security update

Bulletin has no description...

DSA-3963-1 mercurial - security update

Bulletin has no description...

SUSE-SU-2015:0836-1 Security update for mercurial

Mercurial was updated to fix a command injection via sshpeer.validaterepo CVE-2014-9462, bnc923070:...

CVE-2008-4297

Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbitrary files from a repository via an "hg pull" request...

CVE-2008-2942

Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." dot dot sequences in a patch file...