CVE-2018-13348

Published: 06 July 2018

The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.

From the Ubuntu security team

It was discovered that Mercurial incorrectly handled certain patch data. An attacker could possibly use this issue to cause a denial of service or other unspecified impact.

Priority

Medium

CVSS 3 base score: 7.5

Status

Package Release Status
mercurial
Launchpad, Ubuntu, Debian
Upstream
Released (4.6.1-1)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (4.5.3-1ubuntu2.1)
Ubuntu 16.04 LTS (Xenial Xerus)
Released (3.7.3-1ubuntu1.1)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (2.8.2-1ubuntu1.4)