CVE-2018-13348
Fixed in a distro release EPSS 2%
The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.
Products: mercurial
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | mercurial | 4.6.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | mercurial | 4.6.1-1 |
| Debian 13 | mercurial | 4.6.1-1 |
| Debian 14 | mercurial | 4.6.1-1 |
| Debian 8 | mercurial | 3.1.2-2+deb8u5 |
| Debian 9 | mercurial | 4.0-1+deb9u2 |
| SUSE Linux Enterprise Module for Development Tools 15 | mercurial | 4.5.2-3.3.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | mercurial | 2.3.2-0.18.9.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | mercurial | 2.8.2-15.13.1 |
| Ubuntu 14.04 LTS | mercurial | 2.8.2-1ubuntu1.4 |
| Ubuntu 16.04 LTS | mercurial | 3.7.3-1ubuntu1.1 |
| Ubuntu 18.04 LTS | mercurial | 4.5.3-1ubuntu2.1 |
| openSUSE Tumbleweed | mercurial | 5.9.1-2.1 |