bugtraq - [slackware-security] mercurial (SSA:2017-223-03)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <alpine.LNX.2.02.1708111611100.21755@connie.slackware.com>
Date: Fri, 11 Aug 2017 16:11:24 -0700 (PDT)
From: Slackware Security Team <security@...ckware.com>
To: slackware-security@...ckware.com
Subject: [slackware-security]  mercurial (SSA:2017-223-03)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[slackware-security]  mercurial (SSA:2017-223-03)

New mercurial packages are available for Slackware 14.0, 14.1, 14.2,
and -current to fix security issues.


Here are the details from the Slackware 14.2 ChangeLog:
+--------------------------+
patches/packages/mercurial-4.3.1-i586-1_slack14.2.txz:  Upgraded.
  Fixes security issues:
  Mercurial's symlink auditing was incomplete prior to 4.3, and could
  be abused to write to files outside the repository.
  Mercurial was not sanitizing hostnames passed to ssh, allowing
  shell injection attacks on clients by specifying a hostname starting
  with -oProxyCommand.
  For more information, see:
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000115
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000116
  (* Security fix *)
+--------------------------+


Where to find the new packages:
+-----------------------------+

Thanks to the friendly folks at the OSU Open Source Lab
(http://osuosl.org) for donating FTP and rsync hosting
to the Slackware project!  :-)

Also see the "Get Slack" section on http://slackware.com for
additional mirror sites near you.

Updated package for Slackware 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware-14.0/patches/packages/mercurial-4.3.1-i486-1_slack14.0.txz

Updated package for Slackware x86_64 14.0:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.0/patches/packages/mercurial-4.3.1-x86_64-1_slack14.0.txz

Updated package for Slackware 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware-14.1/patches/packages/mercurial-4.3.1-i486-1_slack14.1.txz

Updated package for Slackware x86_64 14.1:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.1/patches/packages/mercurial-4.3.1-x86_64-1_slack14.1.txz

Updated package for Slackware 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware-14.2/patches/packages/mercurial-4.3.1-i586-1_slack14.2.txz

Updated package for Slackware x86_64 14.2:
ftp://ftp.slackware.com/pub/slackware/slackware64-14.2/patches/packages/mercurial-4.3.1-x86_64-1_slack14.2.txz

Updated package for Slackware -current:
ftp://ftp.slackware.com/pub/slackware/slackware-current/slackware/d/mercurial-4.3.1-i586-1.txz

Updated package for Slackware x86_64 -current:
ftp://ftp.slackware.com/pub/slackware/slackware64-current/slackware64/d/mercurial-4.3.1-x86_64-1.txz


MD5 signatures:
+-------------+

Slackware 14.0 package:
4d9a2a90109202aa2023ff758f8e2b88  mercurial-4.3.1-i486-1_slack14.0.txz

Slackware x86_64 14.0 package:
c949af25a3a61ba5b88780b2e10b02d5  mercurial-4.3.1-x86_64-1_slack14.0.txz

Slackware 14.1 package:
9260d7fa714eea9a81fb9bc6d56708d4  mercurial-4.3.1-i486-1_slack14.1.txz

Slackware x86_64 14.1 package:
f0525de8c1497f154f280dbafcdcd25b  mercurial-4.3.1-x86_64-1_slack14.1.txz

Slackware 14.2 package:
cf70802f8f9a1ec306ebde94eac246fc  mercurial-4.3.1-i586-1_slack14.2.txz

Slackware x86_64 14.2 package:
c44f92967f03ac8724f898451d2b4f2f  mercurial-4.3.1-x86_64-1_slack14.2.txz

Slackware -current package:
b81fe0b2ec0d3923ce12b5d374b21d7e  d/mercurial-4.3.1-i586-1.txz

Slackware x86_64 -current package:
84c3d7646ed899df599435fa32270c83  d/mercurial-4.3.1-x86_64-1.txz


Installation instructions:
+------------------------+

Upgrade the package as root:
# upgradepkg mercurial-4.3.1-i586-1_slack14.2.txz


+-----+

Slackware Linux Security Team
http://slackware.com/gpg-key
security@...ckware.com

+------------------------------------------------------------------------+
| To leave the slackware-security mailing list:                          |
+------------------------------------------------------------------------+
| Send an email to majordomo@...ckware.com with this text in the body of |
| the email message:                                                     |
|                                                                        |
|   unsubscribe slackware-security                                       |
|                                                                        |
| You will get a confirmation message back containing instructions to    |
| complete the process.  Please do not reply to this email address.      |
+------------------------------------------------------------------------+
-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAlmOOS4ACgkQakRjwEAQIjPvfACeNOO4iu5cLHu6f5t90EXlt9u5
sGAAn2jOYnKcJrbj6XjajgGjZ05d+YZA
=ghV8
-----END PGP SIGNATURE-----