PT-2018-3608 · Mercurial+4 · Mercurial+4

Published 2018-07-05 · Updated 2022-05-13 · CVE-2018-13347

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 4.6.1

Description The issue is related to an integer overflow in the mpatch.c component of the Mercurial version control system. This can be exploited by a remote attacker to access confidential data, compromise data integrity, and cause a denial of service. The vulnerability is due to the mishandling of integer addition and subtraction.

Recommendations For versions prior to 4.6.1, update to version 4.6.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the mpatch.c component until a patch is applied.

Fix

Integer Overflow

Weakness Enumeration

CWE-190

Related Identifiers

ALT-PU-2018-2508

BDU:2021-01285

CESA-2019_2276

CVE-2018-13347

DLA-1414-1

DLA-2293-1

GHSA-3MJJ-MR4F-QXMX

MGASA-2018-0355

OPENSUSE-SU-2018_2023-1

OPENSUSE-SU-2018_2132-1

PYSEC-2018-89

RHSA-2019:2276

RHSA-2019_2276

SUSE-SU-2018:1990-1

SUSE-SU-2018:1996-1

SUSE-SU-2018:1998-1

Affected Products

Alt Linux

Centos

Mercurial

Red Hat

Suse

References · 36

• https://mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2018:1996-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2018-13347 · Security Note
• https://mercurial-scm.org/repo/hg/rev/1acfc35d478c · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2018-13347 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-13347 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-13347 · Vendor Advisory
• https://ubuntu.com/security/CVE-2018-13347 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2293-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01285 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2018:1998-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2018-89 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13347 · Security Note
• https://mercurial-scm.org/repo/hg-committed/log?rev=modifies%28%22mercurial%2Fmpatch.c%22%29+and+4.5%3A%3A · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1414-1 · Vendor Advisory