Описание
Security update for mercurial
This update for mercurial fixes the following issues:
- CVE-2017-9462: Arbitrary code execution was possible by remote users via 'hg serve --stdio' (bsc#1043063):
Список пакетов
SUSE Linux Enterprise Software Development Kit 11 SP4
mercurial-2.3.2-0.17.1
Ссылки
- Link for SUSE-SU-2017:1558-1
- E-Mail link for SUSE-SU-2017:1558-1
- SUSE Security Ratings
- SUSE Bug 1043063
- SUSE Bug 1043502
- SUSE CVE CVE-2017-9462 page
Описание
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
Затронутые продукты
SUSE Linux Enterprise Software Development Kit 11 SP4:mercurial-2.3.2-0.17.1
Ссылки
- CVE-2017-9462
- SUSE Bug 1043063