CVE 2016-3068

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository.

Related bugs and status

CVE-2016-3068 (Candidate) is related to these bugs:

Bug #1759366: Multiple Mercurial CVEs have been announced

		In	Importance	Status
1759366	Multiple Mercurial CVEs have been announced	mercurial (Ubuntu)	High	Fix Released
1759366	Multiple Mercurial CVEs have been announced	mercurial (Ubuntu Xenial)	High	Confirmed
1759366	Multiple Mercurial CVEs have been announced	mercurial (Ubuntu Trusty)	High	Confirmed

See the

CVE page on Mitre.org for more details.