Versions mentioned in the description apply to the upstream
Remediation section below for
Debian:8 relevant versions.
A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
mercurial to version 3.1.2-2+deb8u7 or higher.