Launchpad.net

CVE 2016-3105

The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository name.

CVE-2016-3105 (Candidate) is related to these bugs:

Bug #1759366: Multiple Mercurial CVEs have been announced

		In	Importance	Status
1759366	Multiple Mercurial CVEs have been announced	mercurial (Ubuntu)	High	Fix Released
1759366	Multiple Mercurial CVEs have been announced	mercurial (Ubuntu Xenial)	High	Confirmed
1759366	Multiple Mercurial CVEs have been announced	mercurial (Ubuntu Trusty)	High	Confirmed

See the

CVE page on Mitre.org for more details.