Launchpad.net

CVE 2016-3069

Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository.

CVE-2016-3069 (Candidate) is related to these bugs:

Bug #1759366: Multiple Mercurial CVEs have been announced

		In	Importance	Status
1759366	Multiple Mercurial CVEs have been announced	mercurial (Ubuntu)	High	Fix Released
1759366	Multiple Mercurial CVEs have been announced	mercurial (Ubuntu Xenial)	High	Confirmed
1759366	Multiple Mercurial CVEs have been announced	mercurial (Ubuntu Trusty)	High	Confirmed

See the

CVE page on Mitre.org for more details.