opensuse-su-2024:10586-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
mercurial-5.9.1-2.1 on GA media

Notes

Title of the patch
mercurial-5.9.1-2.1 on GA media
Description of the patch
These are all security issues fixed in the mercurial-5.9.1-2.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-10586
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "mercurial-5.9.1-2.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the mercurial-5.9.1-2.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2024-10586",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_10586-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2008-2942 page",
        "url": "https://www.suse.com/security/cve/CVE-2008-2942/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-1000115 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-1000115/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-1000116 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-1000116/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2017-17458 page",
        "url": "https://www.suse.com/security/cve/CVE-2017-17458/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-1000132 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-1000132/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-13346 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-13346/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-13348 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-13348/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2018-17983 page",
        "url": "https://www.suse.com/security/cve/CVE-2018-17983/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2019-3902 page",
        "url": "https://www.suse.com/security/cve/CVE-2019-3902/"
      }
    ],
    "title": "mercurial-5.9.1-2.1 on GA media",
    "tracking": {
      "current_release_date": "2024-06-15T00:00:00Z",
      "generator": {
        "date": "2024-06-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2024:10586-1",
      "initial_release_date": "2024-06-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2024-06-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mercurial-5.9.1-2.1.aarch64",
                "product": {
                  "name": "mercurial-5.9.1-2.1.aarch64",
                  "product_id": "mercurial-5.9.1-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "mercurial-lang-5.9.1-2.1.aarch64",
                "product": {
                  "name": "mercurial-lang-5.9.1-2.1.aarch64",
                  "product_id": "mercurial-lang-5.9.1-2.1.aarch64"
                }
              },
              {
                "category": "product_version",
                "name": "mercurial-tests-5.9.1-2.1.aarch64",
                "product": {
                  "name": "mercurial-tests-5.9.1-2.1.aarch64",
                  "product_id": "mercurial-tests-5.9.1-2.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mercurial-5.9.1-2.1.ppc64le",
                "product": {
                  "name": "mercurial-5.9.1-2.1.ppc64le",
                  "product_id": "mercurial-5.9.1-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "mercurial-lang-5.9.1-2.1.ppc64le",
                "product": {
                  "name": "mercurial-lang-5.9.1-2.1.ppc64le",
                  "product_id": "mercurial-lang-5.9.1-2.1.ppc64le"
                }
              },
              {
                "category": "product_version",
                "name": "mercurial-tests-5.9.1-2.1.ppc64le",
                "product": {
                  "name": "mercurial-tests-5.9.1-2.1.ppc64le",
                  "product_id": "mercurial-tests-5.9.1-2.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mercurial-5.9.1-2.1.s390x",
                "product": {
                  "name": "mercurial-5.9.1-2.1.s390x",
                  "product_id": "mercurial-5.9.1-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "mercurial-lang-5.9.1-2.1.s390x",
                "product": {
                  "name": "mercurial-lang-5.9.1-2.1.s390x",
                  "product_id": "mercurial-lang-5.9.1-2.1.s390x"
                }
              },
              {
                "category": "product_version",
                "name": "mercurial-tests-5.9.1-2.1.s390x",
                "product": {
                  "name": "mercurial-tests-5.9.1-2.1.s390x",
                  "product_id": "mercurial-tests-5.9.1-2.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "mercurial-5.9.1-2.1.x86_64",
                "product": {
                  "name": "mercurial-5.9.1-2.1.x86_64",
                  "product_id": "mercurial-5.9.1-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "mercurial-lang-5.9.1-2.1.x86_64",
                "product": {
                  "name": "mercurial-lang-5.9.1-2.1.x86_64",
                  "product_id": "mercurial-lang-5.9.1-2.1.x86_64"
                }
              },
              {
                "category": "product_version",
                "name": "mercurial-tests-5.9.1-2.1.x86_64",
                "product": {
                  "name": "mercurial-tests-5.9.1-2.1.x86_64",
                  "product_id": "mercurial-tests-5.9.1-2.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-5.9.1-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64"
        },
        "product_reference": "mercurial-5.9.1-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-5.9.1-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le"
        },
        "product_reference": "mercurial-5.9.1-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-5.9.1-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x"
        },
        "product_reference": "mercurial-5.9.1-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-5.9.1-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64"
        },
        "product_reference": "mercurial-5.9.1-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-lang-5.9.1-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64"
        },
        "product_reference": "mercurial-lang-5.9.1-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-lang-5.9.1-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le"
        },
        "product_reference": "mercurial-lang-5.9.1-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-lang-5.9.1-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x"
        },
        "product_reference": "mercurial-lang-5.9.1-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-lang-5.9.1-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64"
        },
        "product_reference": "mercurial-lang-5.9.1-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-tests-5.9.1-2.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64"
        },
        "product_reference": "mercurial-tests-5.9.1-2.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-tests-5.9.1-2.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le"
        },
        "product_reference": "mercurial-tests-5.9.1-2.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-tests-5.9.1-2.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x"
        },
        "product_reference": "mercurial-tests-5.9.1-2.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "mercurial-tests-5.9.1-2.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
        },
        "product_reference": "mercurial-tests-5.9.1-2.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2008-2942",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2008-2942"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via \"..\" (dot dot) sequences in a patch file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2008-2942",
          "url": "https://www.suse.com/security/cve/CVE-2008-2942"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 404959 for CVE-2008-2942",
          "url": "https://bugzilla.suse.com/404959"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2008-2942"
    },
    {
      "cve": "CVE-2017-1000115",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-1000115"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-1000115",
          "url": "https://www.suse.com/security/cve/CVE-2017-1000115"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1053344 for CVE-2017-1000115",
          "url": "https://bugzilla.suse.com/1053344"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-1000115"
    },
    {
      "cve": "CVE-2017-1000116",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-1000116"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-1000116",
          "url": "https://www.suse.com/security/cve/CVE-2017-1000116"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1052481 for CVE-2017-1000116",
          "url": "https://bugzilla.suse.com/1052481"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1052696 for CVE-2017-1000116",
          "url": "https://bugzilla.suse.com/1052696"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1052932 for CVE-2017-1000116",
          "url": "https://bugzilla.suse.com/1052932"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1053364 for CVE-2017-1000116",
          "url": "https://bugzilla.suse.com/1053364"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1054653 for CVE-2017-1000116",
          "url": "https://bugzilla.suse.com/1054653"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1066430 for CVE-2017-1000116",
          "url": "https://bugzilla.suse.com/1066430"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1071709 for CVE-2017-1000116",
          "url": "https://bugzilla.suse.com/1071709"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2017-1000116"
    },
    {
      "cve": "CVE-2017-17458",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2017-17458"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2017-17458",
          "url": "https://www.suse.com/security/cve/CVE-2017-17458"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1071715 for CVE-2017-17458",
          "url": "https://bugzilla.suse.com/1071715"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2017-17458"
    },
    {
      "cve": "CVE-2018-1000132",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-1000132"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-1000132",
          "url": "https://www.suse.com/security/cve/CVE-2018-1000132"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1085211 for CVE-2018-1000132",
          "url": "https://bugzilla.suse.com/1085211"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-1000132"
    },
    {
      "cve": "CVE-2018-13346",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-13346"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-13346",
          "url": "https://www.suse.com/security/cve/CVE-2018-13346"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1100354 for CVE-2018-13346",
          "url": "https://bugzilla.suse.com/1100354"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-13346"
    },
    {
      "cve": "CVE-2018-13348",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-13348"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-13348",
          "url": "https://www.suse.com/security/cve/CVE-2018-13348"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1100353 for CVE-2018-13348",
          "url": "https://bugzilla.suse.com/1100353"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-13348"
    },
    {
      "cve": "CVE-2018-17983",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2018-17983"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2018-17983",
          "url": "https://www.suse.com/security/cve/CVE-2018-17983"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1110899 for CVE-2018-17983",
          "url": "https://bugzilla.suse.com/1110899"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2018-17983"
    },
    {
      "cve": "CVE-2019-3902",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2019-3902"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial\u0027s path-checking logic and write files outside a repository.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
          "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2019-3902",
          "url": "https://www.suse.com/security/cve/CVE-2019-3902"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1133035 for CVE-2019-3902",
          "url": "https://bugzilla.suse.com/1133035"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.0"
          },
          "products": [
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-lang-5.9.1-2.1.x86_64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.aarch64",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.ppc64le",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.s390x",
            "openSUSE Tumbleweed:mercurial-tests-5.9.1-2.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2024-06-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2019-3902"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.