Slackware: 2017-223-03 Moderate: Mercurial Symlink and SSH Injection
slackware
August 11, 2017
New mercurial packages are available for Slackware 14.0, 14.1, 14.2, and -current to fix security issues
Summary
Here are the details from the Slackware 14.2 ChangeLog: patches/packages/mercurial-4.3.1-i586-1_slack14.2.txz: Upgraded. Fixes security issues: Mercurial's symlink auditing was incomplete prior to 4.3, and could be abused to write to files outside the repository. Mercurial was not sanitizing hostnames passed to ssh, allowing shell injection attacks on clients by specifying a hostname starting with -oProxyCommand. For more information, see: https://www.cve.org/CVERecord?id=CVE-2017-1000115 https://www.cve.org/CVERecord?id=CVE-2017-1000116 (* Security fix *)
Where Find New Packages
Thanks to the friendly folks at the OSU Open Source Lab
(https://osuosl.org/) for donating FTP and rsync hosting
to the Slackware project! :-)
Also see the "Get Slack" section on http://www.slackware.com/ for
additional mirror sites near you.
Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mercurial-4.3.1-i486-1_slack14.0.txz
Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mercurial-4.3.1-x86_64-1_slack14.0.txz
Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mercurial-4.3.1-i486-1_slack14.1.txz
Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mercurial-4.3.1-x86_64-1_slack14.1.txz
Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/mercurial-4.3.1-i586-1_slack14.2.txz
Updated package ...
MD5 Signatures
Slackware 14.0 package:
4d9a2a90109202aa2023ff758f8e2b88 mercurial-4.3.1-i486-1_slack14.0.txz
Slackware x86_64 14.0 package:
c949af25a3a61ba5b88780b2e10b02d5 mercurial-4.3.1-x86_64-1_slack14.0.txz
Slackware 14.1 package:
9260d7fa714eea9a81fb9bc6d56708d4 mercurial-4.3.1-i486-1_slack14.1.txz
Slackware x86_64 14.1 package:
f0525de8c1497f154f280dbafcdcd25b mercurial-4.3.1-x86_64-1_slack14.1.txz
Slackware 14.2 package:
cf70802f8f9a1ec306ebde94eac246fc mercurial-4.3.1-i586-1_slack14.2.txz
Slackware x86_64 14.2 package:
c44f92967f03ac8724f898451d2b4f2f mercurial-4.3.1-x86_64-1_slack14.2.txz
Slackware -current package:
b81fe0b2ec0d3923ce12b5d374b21d7e d/mercurial-4.3.1-i586-1.txz
Slackware x86_64 -current package:
84c3d7646ed899df599435fa32270c83 d/mercurial-4.3.1-x86_64-1.txz
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Installation Instructions
Installation instructions: Upgrade the package as root: # upgradepkg mercurial-4.3.1-i586-1_slack14.2.txz
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!