Lucene search
Veracode Vulnerability DatabaseVERACODE:12505HistoryJan 15, 2019 - 9:17 a.m.
Remote Code Execution (RCE)
2019-01-1509:17:56
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
8
0.03 Low
EPSS
Percentile
91.0%
Mecurial is vulnerable to remote code execution (RCE). The hg serve --stdio command allows a malicious user to launch the python debugger to execute arbitrary python code by using --debugger as the target repository.
| CPE | Name | Operator | Version |
|---|---|---|---|
| mercurial | eq | 1.4__4.el6 | |
| mercurial | eq | 1.4__3.el6 |
References
www.debian.org/security/2017/dsa-3963
www.securityfocus.com/bid/99123
access.redhat.com/errata/RHSA-2017:1576
access.redhat.com/security/updates/classification/#important
bugs.debian.org/861243
lists.debian.org/debian-lts-announce/2018/07/msg00005.html
security.gentoo.org/glsa/201709-18
www.mercurial-scm.org/repo/hg/rev/77eaf9539499
www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29
Related
nessus
nessus
Fedora 24 : mercurial (2017-b154ff2892)
2017-06-28 00:00:00
RHEL 6 / 7 : mercurial (RHSA-2017:1576)
2017-06-28 00:00:00
Oracle Linux 6 / 7 : mercurial (ELSA-2017-1576)
2017-06-28 00:00:00
amazon
amazon
Important: mercurial
2017-07-06 19:06:00
openvas
openvas
openSUSE: Security Advisory for mercurial (openSUSE-SU-2017:1572-1)
2017-06-16 00:00:00
CentOS Update for emacs-mercurial CESA-2017:1576 centos6
2017-06-29 00:00:00
Debian: Security Advisory (DLA-1005-1)
2018-01-28 00:00:00
oraclelinux
oraclelinux
mercurial security update
2017-06-27 00:00:00
hackerone
hackerone
mageia
mageia
Updated mercurial packages fix security vulnerability
2017-06-26 12:28:17
osv
osv
PYSEC-2017-91
2017-06-06 21:29:00
mercurial - security update
2017-06-29 00:00:00
High severity vulnerability that affects mercurial
2018-07-13 15:17:10
nvd
nvd
CVE-2017-9462
2017-06-06 21:29:00
redhat
redhat
(RHSA-2017:1576) Important: mercurial security update
2017-06-27 05:25:17
fedora
fedora
[SECURITY] Fedora 24 Update: mercurial-3.7.3-2.fc24
2017-06-26 23:48:18
[SECURITY] Fedora 25 Update: mercurial-3.8.1-3.fc25
2017-06-27 01:52:10
redhatcve
redhatcve
CVE-2017-9462
2017-06-07 09:37:33
veracode
veracode
Remote Code Execution (RCE)
2017-06-07 05:04:32
debian
debian
[SECURITY] [DLA 1005-1] mercurial security update
2017-06-29 19:14:13
[SECURITY] [DSA 3963-1] mercurial security update
2017-09-04 07:05:20
[SECURITY] [DLA 1414-1] mercurial security update
2018-07-05 21:00:52
github
github
High severity vulnerability that affects mercurial
2018-07-13 15:17:10
suse
suse
Security update for mercurial (important)
2017-06-15 18:11:09
Security update for mercurial (important)
2017-06-13 21:10:53
Security update for mercurial (important)
2017-06-19 15:14:55
cvelist
cvelist
CVE-2017-9462
2017-06-06 21:00:00
prion
prion
Design/Logic Flaw
2017-06-06 21:29:00
cve
cve
CVE-2017-9462
2017-06-06 21:29:00
centos
centos
emacs, mercurial security update
2017-06-28 19:23:17
debiancve
debiancve
CVE-2017-9462
2017-06-06 21:29:00
ubuntucve
ubuntucve
CVE-2017-9462
2017-06-06 00:00:00
gentoo
gentoo
Mercurial: Multiple vulnerabilities
2017-09-24 00:00:00
avleonov
avleonov
Vulnerability Management at Tinkoff Fintech School
2019-03-04 10:38:31