CVE-2018-13346 Mercurial Improper Input Validation vulnerability
Mercurial incorrectly handles patch fragments starting past data end, potentially causing crashes or unexpected behavior during patch application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-13346?
CVE-2018-13346 is a high-severity vulnerability in n/a, published on 6 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.
Weakness: CWE-20
Which versions are affected by CVE-2018-13346?
3 open source packages ship an affected version, including mercurial. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mercurial PyPI | All versions | 4.6.1 |
mercurial PyPI | All versions | 4.6.1 |
mercurial PyPI | All versions | 4.6.1 |
Products include Mercurial Mercurial.
How do I fix CVE-2018-13346?
Upgrade mercurial to 4.6.1 or later.
Is CVE-2018-13346 being exploited?
There is no known exploitation of CVE-2018-13346 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2018-13347 Mercurial mishandles integer addition and subtraction
- CVE-2018-17983 Mercurial Out-of-bounds Read vulnerability
- CVE-2018-13348 Mercurial Improper Input Validation vulnerability
- CVE-2014-9462 Mercurial vulnerable to arbitrary command execution via a crafted repository name in a clone command
- CVE-2008-2942 Mercurial Directory traversal vulnerability
Sources
Also known as DEBIAN-CVE-2018-13346, GHSA-9xv4-r2hf-26gh, PYSEC-2018-88, UBUNTU-CVE-2018-13346.