Advisories » MGASA-2015-0129

Updated mercurial packages fix CVE-2014-9462

Publication date: 03 Apr 2015
Type: security
Affected Mageia releases : 4
CVE: CVE-2014-9462

Description

Updated mercurial packages fix security vulnerability:

The mercurial source code management system suffers from a code-injection
flaw due to insufficient shell quoting in sshpeer._validaterepo()
(CVE-2014-9462).
                

References

• https://bugs.mageia.org/show_bug.cgi?id=15590
• http://chargen.matasano.com/chargen/2015/3/17/this-new-vulnerability-mercurial-command-injection-cve-2014-9462.html
• http://lists.opensuse.org/opensuse-updates/2015-03/msg00085.html
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9462

SRPMS

4/core

• mercurial-2.7.2-3.1.mga4