Buffer overflow in Mercurial - CVE-2018-13346
Published: August 6, 2018 / Updated: August 7, 2018
Vulnerability identifier: #VU14211
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-13346
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition on the target system.
The vulnerability exists due to boundary error when the mpatch_apply function in mpatch.c incorrectly proceeds in cases where the fragment start is past the end of the original data. A remote unauthenticated attacker can supply specially crafted input, trigger memory corruption and cause the service to crash.
Affected software
Mercurial
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Opensuse
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Opensuse
How to mitigate CVE-2018-13346
Update to version 4.6.1.
Mercurial - update to 4.6.1