CVE-2018-13348: Input Validation
The mpatchdecode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.
Other sources
The mpatchdecode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-13348.
What is the severity of CVE-2018-13348?
The severity of CVE-2018-13348 is high with a CVSS score of 7.5.
What software is affected by CVE-2018-13348?
Mercurial versions up to and excluding 4.6.1 are affected by CVE-2018-13348.
How does the vulnerability in CVE-2018-13348 manifest?
The vulnerability in CVE-2018-13348 manifests in the mishandling of certain situations in the mpatch_decode function in Mercurial before 4.6.1.
Is there a fix available for CVE-2018-13348?
Yes, the fix for CVE-2018-13348 is included in Mercurial version 4.6.1 and later.