PT-2018-3608 · Mercurial+4 · Mercurial+4

Publicado 2018-07-05 · Atualizado 2022-05-13 · CVE-2018-13347

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 4.6.1

Description The issue is related to an integer overflow in the mpatch.c component of the Mercurial version control system. This can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. The vulnerability is due to the mishandling of integer addition and subtraction.

Recommendations For versions prior to 4.6.1, update to version 4.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the mpatch.c component until a patch is applied.

Correção

Integer Overflow

Enumeração de Fraquezas

CWE-190

Identificadores relacionados

ALT-PU-2018-2508

BDU:2021-01285

CESA-2019_2276

CVE-2018-13347

DLA-1414-1

DLA-2293-1

GHSA-3MJJ-MR4F-QXMX

MGASA-2018-0355

OPENSUSE-SU-2018_2023-1

OPENSUSE-SU-2018_2132-1

PYSEC-2018-89

RHSA-2019:2276

RHSA-2019_2276

SUSE-SU-2018:1990-1

SUSE-SU-2018:1996-1

SUSE-SU-2018:1998-1

Produtos afetados

Alt Linux

Centos

Mercurial

Red Hat

Suse

Referências · 36

• https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-89.yaml · Nota
• https://mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29 · Aviso do Fabricante
• https://osv.dev/vulnerability/SUSE-SU-2018:1996-1 · Aviso do Fabricante
• https://cve.org/CVERecord?id=CVE-2018-13347 · Nota de Segurança
• https://bugzilla.suse.com/1100355 · Nota
• https://mercurial-scm.org/repo/hg/rev/1acfc35d478c · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2018-13347 · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-13347 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2018-13347 · Aviso do Fabricante
• https://lists.opensuse.org/opensuse-updates/2018-07/msg00057.html · Nota
• https://osv.dev/vulnerability/CVE-2018-13347 · Aviso do Fabricante
• https://bugzilla.suse.com/1100353 · Nota
• https://bugzilla.suse.com/1100354 · Nota
• https://suse.com/support/update/announcement/2018/suse-su-20181998-1 · Nota
• https://ubuntu.com/security/CVE-2018-13347 · Aviso do Fabricante