PT-2018-14313 · Mercurial+3 · Mercurial+3

Yuya Nishihara · Publicado 2018-10-04 · Atualizado 2024-06-15 · CVE-2018-17983

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 4.7.2

Description The issue is related to an out-of-bounds read that occurs during the parsing of a malformed manifest entry in the cext/manifest.c file. This can potentially lead to information disclosure or other security issues.

Recommendations For Mercurial versions prior to 4.7.2, update to version 4.7.2 or later to resolve the issue. As a temporary workaround, consider restricting access to malformed manifest entries until the update is applied.

Correção

Out of bounds Read

Enumeração de Fraquezas

CWE-125

Identificadores relacionados

ALT-PU-2018-2508

CVE-2018-17983

GHSA-P575-CF9H-WV42

MGASA-2018-0442

OPENSUSE-SU-2018_3517-1

OPENSUSE-SU-2024:10586-1

PYSEC-2018-91

SUSE-SU-2018:3430-1

SUSE-SU-2018_3430-1

USN-5102-1

USN-5102-2

Produtos afetados

Alt Linux

Mercurial

Suse

Ubuntu

Referências · 34

• https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-91.yaml · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-17983 · Nota de Segurança
• https://ubuntu.com/security/CVE-2019-3902 · Aviso do Fabricante
• https://osv.dev/vulnerability/PYSEC-2018-91 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2019-3902 · Nota
• https://advisories.mageia.org/MGASA-2018-0442.html · Nota de Segurança
• https://suse.com/security/cve/CVE-2017-1000115 · Nota
• https://bugzilla.suse.com/1110899 · Nota
• https://suse.com/security/cve/CVE-2008-2942 · Nota
• https://osv.dev/vulnerability/CVE-2018-17983 · Aviso do Fabricante
• https://mercurial-scm.org/repo/hg/rev/5405cb1a7901 · Correção
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-17983 · Aviso do Fabricante
• https://mercurial-scm.org/wiki/WhatsNew#Mercurial_4.7.2_.282018-10-01.29 · Nota
• https://suse.com/security/cve/CVE-2018-13348 · Nota
• https://suse.com/security/cve/CVE-2017-17458 · Nota