Skip to content
OpenAdvisories
Medium ELSA-2019-2276 3 CVEs

Moderate: mercurial security update (Oracle Linux 7)

Published Aug 13, 2019 · Updated Aug 13, 2019

Ecosystem: Oracle Linux

Summary

[2.6.2-10]
- Add missing hunk for CVE-2018-13347 patch
- Related: CVE-2018-13347

[2.6.2-9]
- Fix various CVEs
- Resolves: CVE-2018-1000132 CVE-2018-13346 CVE-2018-13347

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 7 emacs-mercurial 0:2.6.2-10.el7
Oracle Linux · 7 emacs-mercurial-el 0:2.6.2-10.el7
Oracle Linux · 7 mercurial 0:2.6.2-10.el7
Oracle Linux · 7 mercurial-hgk 0:2.6.2-10.el7

Vulnerabilities 3

  • Critical 9.8
    CVE-2018-13347

    Mercurial mishandles integer addition and subtraction

    mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.

    mercurial mercurial mercurial Debian Ubuntu PyPI
  • Critical 9.1
    CVE-2018-1000132

    Mercurial Incorrect Access Control vulnerability

    Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have bee…

    mercurial mercurial mercurial mercurial Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2018-13346

    Mercurial Improper Input Validation vulnerability

    The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

    mercurial mercurial mercurial Debian Ubuntu PyPI