GHSA-9xv4-r2hf-26gh

Mercurial Improper Input Validation vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2018-13346

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	mercurial	< 4.6.1	4.6.1

Details

As written in the advisory (Markdown source, shown as plain text).

The `mpatch_apply` function in `mpatch.c` in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-13346 advisory
https://access.redhat.com/errata/RHSA-2019:2276 web
https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-88.yaml web
https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html web
https://www.mercurial-scm.org/repo/hg/rev/faa924469635 web
https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29 web