CVE-2018-17983 Mercurial Out-of-bounds Read vulnerability

Critical 9.1 Published 4 Oct 2018 Updated 5 Aug 2024

An out-of-bounds read in Mercurial allows attackers to cause denial of service or disclose sensitive memory contents via malformed manifest entries.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2018-17983?

CVE-2018-17983 is a critical memory corruption vulnerability in n/a, published on 4 Oct 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.

Weakness: CWE-125

Which versions are affected by CVE-2018-17983?

3 open source packages ship an affected version, including mercurial. It affects 1 product.

Package	Affected	Fixed in
`mercurial` PyPI	All versions	`4.7.2`
`mercurial` PyPI	All versions	`4.7.2`
`mercurial` PyPI	All versions	`4.7.2`

Linux distribution packages (1)

mercurial SUSE:Linux Enterprise Module for Development Tools 15 All versions 4.5.2-3.6.1

Products include Mercurial Mercurial.

How do I fix CVE-2018-17983?

Upgrade mercurial to 4.7.2 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-17983 being exploited?

There is no known exploitation of CVE-2018-17983 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2018-17983, GHSA-p575-cf9h-wv42, MGASA-2018-0442, PYSEC-2018-91, SUSE-SU-2018:3430-1, UBUNTU-CVE-2018-17983.