CVE-2018-13348
mercurial: The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be...
CVE-2018-13348 is fixed in 2 products on 1 platform, first by mercurial 4.5.3-1ubuntu2.1, released July 5, 2018. It is not reported as exploited. Patch Radar priority: Routine.
Routine
CVSS
n/a
Medium
Exploitation
None reported
No vendor assessment
CISA KEV
Not listed
Not in the Known Exploited Vulnerabilities catalog
EPSS
0.0215
82nd percentile
The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Linux | |||
| mercurial · Ubuntu 18.04.6 LTS (bionic) | 4.5.3-1ubuntu2.1 | mercurial 4.5.3-1ubuntu2.1 | Jul 5, 2018 |
| mercurial-common · Ubuntu 18.04.6 LTS (bionic) | 4.5.3-1ubuntu2.1 | mercurial-common 4.5.3-1ubuntu2.1 | Jul 5, 2018 |