id: PYSEC-2018-90
details: The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles
  certain situations where there should be at least 12 bytes remaining after the current
  position in the patch data, but actually are not, aka OVE-20180430-0001.
affected:
- package:
    name: mercurial
    ecosystem: PyPI
    purl: pkg:pypi/mercurial
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 4.6.1
  versions:
  - 0.8.1
  - "0.9"
  - 0.9.1
  - 0.9.2
  - 0.9.3
  - 0.9.4
  - 0.9.5
  - "1.0"
  - 1.0.1
  - 1.0.2
  - "1.1"
  - 1.1.1
  - 1.1.2
  - "1.2"
  - 1.2.1
  - "1.3"
  - 1.3.1
  - "1.4"
  - 1.4.1
  - 1.4.2
  - 1.4.3
  - "1.5"
  - 1.5.1
  - 1.5.2
  - 1.5.3
  - 1.5.4
  - "1.6"
  - 1.6.1
  - 1.6.2
  - 1.6.3
  - 1.6.4
  - "1.7"
  - 1.7.1
  - 1.7.2
  - 1.7.3
  - 1.7.5
  - "1.8"
  - 1.8.1
  - 1.8.2
  - 1.8.3
  - 1.8.4
  - "1.9"
  - 1.9.1
  - 1.9.2
  - 1.9.3
  - "2.0"
  - 2.0.1
  - 2.0.2
  - "2.1"
  - 2.1.1
  - 2.1.2
  - "2.2"
  - 2.2.2
  - "2.3"
  - 2.4.1
  - "2.5"
  - 2.5.1
  - 2.5.2
  - "2.6"
  - 2.6.1
  - 2.6.2
  - 2.6.3
  - 2.7.0
  - 2.7.1
  - 2.7.2
  - "2.8"
  - 2.8.1
  - 2.8.2
  - "2.9"
  - 2.9.1
  - "3.0"
  - 3.0.1
  - "3.1"
  - 3.1.1
  - 3.1.2
  - "3.2"
  - 3.2.1
  - 3.2.2
  - 3.2.3
  - 3.2.4
  - "3.3"
  - 3.3-rc
  - 3.3.1
  - 3.3.2
  - 3.3.3
  - "3.4"
  - 3.4-rc
  - 3.4.1
  - 3.4.2
  - "3.5"
  - 3.5-rc
  - 3.5.1
  - 3.5.2
  - "3.6"
  - 3.6-rc
  - 3.6.1
  - 3.6.2
  - 3.6.3
  - "3.7"
  - 3.7-rc
  - 3.7.1
  - 3.7.2
  - 3.7.3
  - "3.8"
  - 3.8-rc
  - 3.8.1
  - 3.8.2
  - 3.8.3
  - 3.8.4
  - "3.9"
  - 3.9-rc
  - 3.9.1
  - 3.9.2
  - "4.0"
  - 4.0-rc
  - 4.0.1
  - 4.0.2
  - "4.1"
  - 4.1-rc
  - 4.1.1
  - 4.1.2
  - 4.1.3
  - "4.2"
  - 4.2-rc
  - 4.2.1
  - 4.2.2
  - 4.2.3
  - "4.3"
  - 4.3-rc
  - 4.3.1
  - 4.3.2
  - 4.3.3
  - 4.3rc0
  - "4.4"
  - 4.4-rc
  - 4.4.1
  - 4.4.2
  - 4.4rc0
  - "4.5"
  - 4.5-rc
  - 4.5.1
  - 4.5.2
  - 4.5.3
  - 4.5rc0
  - "4.6"
  - 4.6rc0
  - 4.6rc1
references:
- type: WEB
  url: https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
- type: WEB
  url: https://www.mercurial-scm.org/repo/hg/rev/90a274965de7
- type: WEB
  url: https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
- type: ADVISORY
  url: https://github.com/advisories/GHSA-3v62-ww8w-758m
aliases:
- CVE-2018-13348
- GHSA-3v62-ww8w-758m
modified: "2021-08-27T03:22:07.326002Z"
published: "2018-07-06T00:29:00Z"