CVEvulnerability
CVE-2018-13348
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-07-06
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-20
Description
The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.
Affected configurations
• mercurial mercurial (< 4.6.1)
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html lists.debian.org
- https://www.mercurial-scm.org/repo/hg/rev/90a274965de7 Patch, Vendor Advisory
- https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29 Vendor Advisory
- https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html lists.debian.org
- https://www.mercurial-scm.org/repo/hg/rev/90a274965de7 Patch, Vendor Advisory
- https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29 Vendor Advisory