Test ID:	1.3.6.1.4.1.25623.1.0.703542
Category:	Debian Local Security Checks
Title:	Debian: Security Advisory (DSA-3542-1)
Summary:	The remote host is missing an update for the Debian 'mercurial' package(s) announced via the DSA-3542-1 advisory.
Description:	Summary: The remote host is missing an update for the Debian 'mercurial' package(s) announced via the DSA-3542-1 advisory. Vulnerability Insight: Several vulnerabilities have been discovered in Mercurial, a distributed version control system. The Common Vulnerabilities and Exposures project identifies the following issues: CVE-2016-3068 Blake Burkhart discovered that Mercurial allows URLs for Git subrepositories that could result in arbitrary code execution on clone. CVE-2016-3069 Blake Burkhart discovered that Mercurial allows arbitrary code execution when converting Git repositories with specially crafted names. CVE-2016-3630 It was discovered that Mercurial does not properly perform bounds-checking in its binary delta decoder, which may be exploitable for remote code execution via clone, push or pull. For the oldstable distribution (wheezy), these problems have been fixed in version 2.2.2-4+deb7u2. For the stable distribution (jessie), these problems have been fixed in version 3.1.2-2+deb8u2. For the unstable distribution (sid), these problems have been fixed in version 3.7.3-1. We recommend that you upgrade your mercurial packages. Affected Software/OS: 'mercurial' package(s) on Debian 7, Debian 8. Solution: Please install the updated package(s). CVSS Score: 6.8 CVSS Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2016-3068 BugTraq ID: 85733 http://www.securityfocus.com/bid/85733 Debian Security Information: DSA-3542 (Google Search) http://www.debian.org/security/2016/dsa-3542 http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181505.html http://lists.fedoraproject.org/pipermail/package-announce/2016-April/181542.html https://security.gentoo.org/glsa/201612-19 RedHat Security Advisories: RHSA-2016:0706 http://rhn.redhat.com/errata/RHSA-2016-0706.html SuSE Security Announcement: SUSE-SU-2016:1010 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00016.html SuSE Security Announcement: SUSE-SU-2016:1011 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00017.html SuSE Security Announcement: openSUSE-SU-2016:1016 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00018.html SuSE Security Announcement: openSUSE-SU-2016:1073 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00043.html Common Vulnerability Exposure (CVE) ID: CVE-2016-3069 Common Vulnerability Exposure (CVE) ID: CVE-2016-3630
Copyright	Copyright (C) 2016 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.