Mercurial '_validaterepo()' Function Command Injection Vulnerability

Bugtraq ID:	73688
Class:	Input Validation Error
CVE:	CVE-2014-9462
Remote:	Yes
Local:	No
Published:	Mar 31 2015 12:00AM
Updated:	May 15 2015 12:04AM
Credit:	Jesse Hertz
Vulnerable:	Mercurial Mercurial 1.6.3 Mercurial Mercurial 1.0.2 Mercurial Mercurial 1.0.1 Mercurial Mercurial 1.6.4 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

Mercurial '_validaterepo()' Function Command Injection Vulnerability

Mercurial is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary commands within the context of the user running the affected application. Failed exploit attempts will result in a denial-of-service condition.

Mercurial '_validaterepo()' Function Command Injection Vulnerability

Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Mercurial '_validaterepo()' Function Command Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Mercurial '_validaterepo()' Function Command Injection Vulnerability

References: