CVE-2018-13346

The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 36%
VendorProductVersion
mercurialmercurial
𝑥
< 4.6.1
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
mercurial
bullseye
5.6.1-4
fixed
bookworm
6.3.2-1
fixed
sid
6.8.2-1
fixed
trixie
6.8.2-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
mercurial
cosmic
not-affected
bionic
Fixed 4.5.3-1ubuntu2.1
released
artful
ignored
xenial
Fixed 3.7.3-1ubuntu1.1
released
trusty
Fixed 2.8.2-1ubuntu1.4
released
Common Weakness Enumeration
References
https://access.redhat.com/errata/RHSA-2019:2276
https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
https://www.mercurial-scm.org/repo/hg/rev/faa924469635
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
https://access.redhat.com/errata/RHSA-2019:2276
https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
https://www.mercurial-scm.org/repo/hg/rev/faa924469635
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29