← All advisories

High severity8.8NVD Advisory· Published May 9, 2016· Updated Jun 17, 2026

CVE-2016-3105

CVE-2016-3105

Description

The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
mercurialPyPI	< 3.8	3.8

Affected products

7

Mercurial/Mercurial
cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*
Range: <=3.7.3
Debian/linux
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
ghsa-coords5 versions
pkg:pypi/mercurial pkg:rpm/opensuse/mercurial&distro=openSUSE%20Tumbleweed pkg:rpm/suse/mercurial&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2011%20SP4 pkg:rpm/suse/mercurial&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012 pkg:rpm/suse/mercurial&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP1
< 3.8+ 4 more
- (no CPE)range: < 3.8
- (no CPE)range: < 4.0-1.1
- (no CPE)range: < 2.3.2-0.14.2
- (no CPE)range: < 2.8.2-9.1
- (no CPE)range: < 2.8.2-9.1

Patches

Vulnerability mechanics

References

11

github.com/advisories/GHSA-49cw-434h-qc57ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2016-3105ghsaADVISORY
www.mercurial-scm.org/wiki/WhatsNewnvdVendor AdvisoryWEB
lists.opensuse.org/opensuse-updates/2016-05/msg00082.htmlnvdWEB
www.debian.org/security/2016/dsa-3570nvdWEB
www.slackware.com/security/viewer.phpnvdWEB
github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2016-28.yamlghsaWEB
security.gentoo.org/glsa/201612-19nvdWEB
selenic.com/hg/rev/a56296f55a5envdWEB
web.archive.org/web/20200228012056/http://www.securityfocus.com/bid/90536ghsaWEB
www.securityfocus.com/bid/90536nvd

News mentions

0

No linked articles in our index yet.