X-Recipient:	archive-cygwin AT delorie DOT com
DomainKey-Signature:	a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:cc:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; q=dns; s=
	default; b=QjTC90l45pjXigRjCYoROZprm+uLCx360oqy4EGIuiQjKuth3fi+I
	8+Ibmg+yf8iysJJ5aEOcLHp20emiNnK65J70vX/oNvB62RhtHshw8GGHDFiqD2m/
	GzQGDoWIbSamn6+UtoE3fXm3gen2jAKir6tn1jiKGEXbt9YF0Vzeqk=
DKIM-Signature:	v=1; a=rsa-sha1; c=relaxed; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:date:from:to:cc:subject:message-id:reply-to
	:references:mime-version:content-type:in-reply-to; s=default;
	bh=mhzaIuoyFGCtGXLHpYZfcOS5hLo=; b=VyKfetcqyF8JPvx3j/Nca28emFvG
	IRaZ5kbMPeOjxtE4qX9dIOlmXwqCuWK9ANlr1esnTH7aGAZdWzziKtvCoO+ibklE
	lvBoRUdRu8v0wkBFtXaSGB2Ja8aRi1ImW9mM+cAF2xU4NuwR8UeQIwLy37nXtcUk
	Cza/610ymJ0HK7k=
Mailing-List:	contact cygwin-help AT cygwin DOT com; run by ezmlm
List-Id:	<cygwin.cygwin.com>
List-Subscribe:	<mailto:cygwin-subscribe AT cygwin DOT com>
List-Archive:	<http://sourceware.org/ml/cygwin/>
List-Post:	<mailto:cygwin AT cygwin DOT com>
List-Help:	<mailto:cygwin-help AT cygwin DOT com>, <http://sourceware.org/ml/#faqs>
Sender:	cygwin-owner AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com
Delivered-To:	mailing list cygwin AT cygwin DOT com
Authentication-Results:	sourceware.org; auth=none
X-Virus-Found:	No
X-Spam-SWARE-Status:	No, score=-96.6 required=5.0 tests=BAYES_00,GOOD_FROM_CORINNA_CYGWIN,KAM_LAZY_DOMAIN_SECURITY,RCVD_IN_PBL,RDNS_DYNAMIC autolearn=ham version=3.3.2 spammy=H*c:HgH, Hx-languages-length:943, H*MI:sk:vz137qh, H*i:sk:vz137qh
X-HELO:	calimero.vinschen.de
Date:	Wed, 20 Apr 2016 10:59:38 +0200
From:	Corinna Vinschen <corinna-cygwin AT cygwin DOT com>
To:	cygwin AT cygwin DOT com
Cc:	Jari Aalto <jari DOT aalto AT cante DOT net>
Subject:	Re: Security update needed for mercurial
Message-ID:	<20160420085938.GA16548@calimero.vinschen.de>
Reply-To:	cygwin AT cygwin DOT com
Mail-Followup-To:	cygwin AT cygwin DOT com, Jari Aalto <jari DOT aalto AT cante DOT net>
References:	<86h9fjdhkf DOT fsf AT gmail DOT com> <vz137qhlfxy DOT fsf AT gmail DOT com>
MIME-Version:	1.0
In-Reply-To:	<vz137qhlfxy.fsf@gmail.com>
User-Agent:	Mutt/1.5.24 (2015-08-30)

--opJtzjQTFsWo+cga
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Apr 19 17:30, Andy Moreton wrote:
> On Sat 02 Apr 2016, Andy Moreton wrote:
>=20
> > Hi,
> >
> > The current package is for mercurial 3.5.1, but upstream have released

Actually the Cygwin mercurial package is at 3.6.3.

> > 3.7.3 as a security release, with fixes for:
> >
> > CVE-2016-3630 Mercurial: remote code execution in binary delta decoding
> > CVE-2016-3068 Mercurial: arbitrary code execution with Git subrepos
> > CVE-2016-3069 Mercurial: arbitrary code execution when converting Git r=
epos
> >
> > Release announcement is here:
> > http://permalink.gmane.org/gmane.comp.version-control.mercurial.general=
/37523
> >
> > Can the cygwin mercurial maintainer please issue an updated package.
> >
>=20
> Is the mercurial maintainer still reading the list ?

I CCed him.


Thanks,
Corinna

--=20
Corinna Vinschen                  Please, send mails regarding Cygwin to
Cygwin Maintainer                 cygwin AT cygwin DOT com
Red Hat

--opJtzjQTFsWo+cga
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2

iQIcBAEBCAAGBQJXF0T6AAoJEPU2Bp2uRE+gWF0P/3tuUdOpzIpVHwawaDXDfpF+
1sxpj7hrxe0If1Q9lb7OseR87HLW7OJGDbszrgCYWHStFz9Q4jhicJcOE3ZpZHL5
6f8CP2o5klZuP6x1UZuuPiojoV4ahiseMAyvqcvHhZlqrbY1jrboF+37mAHPoYRu
4M2lTo1uf5U9uZVIpUP2uVYmFgwMO23F+McDRugepU3oNBHPQddxPc5L66egkAGx
hnnYwle+uYH8x8xpzwNMepQ+M9arSeugT3A6ePrunlCWf9eIhv0jLQjNDfbKoae0
uGFG6D1yJ0HfhRjR+ivpheID//Y5XiriWYkXmcWQQySLN7d3rtwbxJ05cu2Uchty
YFbuNrrJoCb8E1aBJgJet6HSha5R2eqyBi2xDAwgmLQGJE5FIX8Dch75eGQ7OQ9t
cdwjjv2XmnfhwWQPNe5JW96yKwPBaZ1jFHDxZqscRve/uBxhiw2UuzO5GsVDW/Qo
AgRxASbi2cn+tukHgvLtRMlMFyR0Ja8YHIJDd0ozKAtVeKl1oHmJc70BZizHt30r
73ksZRcPQ9pIys6+1LW+l+VJYzxPD7UYWgLWqVz+KQ3eCmr3RFtK+bi43RdnPu0W
J+x/+qwN/ZdXX2kj/B9UnXJswzqisSquFuwV39e7KyPOtSKNC3FPZNgiluyaFy1+
3SXvWu4ljl2QrV9FPHR7
=Ij9v
-----END PGP SIGNATURE-----

--opJtzjQTFsWo+cga--

- Raw text -