The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | centos-upgrade-emacs-mercurialcentos-upgrade-emacs-mercurial-elcentos-upgrade-mercurialcentos-upgrade-mercurial-debuginfocentos-upgrade-mercurial-hgk | Aug 28, 2019 | Jul 6, 2018 |
| Debian | debian-upgrade-mercurial | Feb 25, 2019 | Jul 5, 2018 | |
| Huawei Euleros 2_0_sp2 | huawei-euleros-2_0_sp2-upgrade-mercurial | Jun 17, 2020 | Jul 6, 2018 | |
| Huawei Euleros 2_0_sp3 | huawei-euleros-2_0_sp3-upgrade-mercurial | Nov 19, 2019 | Jul 6, 2018 | |
| Huawei Euleros 2_0_sp5 | huawei-euleros-2_0_sp5-upgrade-mercurial | Nov 19, 2019 | Jul 6, 2018 | |
| Oracle Solaris | oracle-solaris-11-4-upgrade-developer-versioning-mercurial-27-4-7-1-11-4-7-0-1-3-0oracle-solaris-11-4-upgrade-developer-versioning-mercurial-4-7-1-11-4-7-0-1-3-0 | Mar 20, 2019 | Jul 5, 2018 | |
| Oracle_linux | — | oracle-linux-upgrade-emacs-mercurialoracle-linux-upgrade-emacs-mercurial-eloracle-linux-upgrade-mercurialoracle-linux-upgrade-mercurial-hgk | Jul 21, 2020 | Jun 6, 2018 |
| Redhat_linux | no-fix-redhat-rpm-packageredhat-upgrade-emacs-mercurialredhat-upgrade-emacs-mercurial-elredhat-upgrade-mercurialredhat-upgrade-mercurial-debuginforedhat-upgrade-mercurial-hgk | Aug 7, 2019 | Jul 6, 2018 | |
| Suse | — | suse-upgrade-mercurialsuse-upgrade-mercurial-lang | Jul 20, 2018 | Jul 5, 2018 |
| Ubuntu | ubuntu-upgrade-mercurial | Nov 19, 2024 | Jul 6, 2018 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Jul 6, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub