Skip to content
OpenAdvisories
Critical RHSA-2019:2276 3 CVEs

Red Hat Security Advisory: mercurial security update

Published Sep 16, 2024 · Updated Jun 27, 2026

Ecosystem: Red Hat

Fixed packages 20

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::client emacs-mercurial 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::client emacs-mercurial-el 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::client mercurial 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::client mercurial-debuginfo 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::client mercurial-hgk 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode emacs-mercurial 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode emacs-mercurial-el 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode mercurial 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode mercurial-debuginfo 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::computenode mercurial-hgk 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::server emacs-mercurial 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::server emacs-mercurial-el 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::server mercurial 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::server mercurial-debuginfo 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::server mercurial-hgk 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation emacs-mercurial 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation emacs-mercurial-el 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation mercurial 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation mercurial-debuginfo 0:2.6.2-10.el7
Red Hat · RHEL 7 enterprise_linux:7::workstation mercurial-hgk 0:2.6.2-10.el7

Vulnerabilities 3

  • Critical 9.8
    CVE-2018-13347

    Mercurial mishandles integer addition and subtraction

    mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.

    mercurial mercurial mercurial Debian Ubuntu PyPI
  • Critical 9.1
    CVE-2018-1000132

    Mercurial Incorrect Access Control vulnerability

    Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have bee…

    mercurial mercurial mercurial mercurial Debian Ubuntu Alpine PyPI
  • High 7.5
    CVE-2018-13346

    Mercurial Improper Input Validation vulnerability

    The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

    mercurial mercurial mercurial Debian Ubuntu PyPI

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1553265
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1594087
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1594090
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2276.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-13346
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-13346
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-13346
  • report
    https://access.redhat.com/security/cve/CVE-2018-13347
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-13347
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-13347
  • report
    https://access.redhat.com/security/cve/CVE-2018-1000132
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-1000132
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-1000132