Mercurial Improper Input Validation vulnerability

HIGH 7.5CVE-2018-13346 · GHSA-9xv4-r2hf-26gh · PYSEC-2018-88 · Published 06/07/2018 · updated 17/06/2026

In short

CVE-2018-13346 is a HIGH (CVSS 7.5) vulnerability affecting mercurial, mercurial (mercurial).
Chance of exploitation in the next 30 days (EPSS): 2.4%, higher than 83.8% of all vulnerabilities.
Fix: update to 4.6.1 or later.

Package	Affected versions	Patched versions
mercurial PyPI	`< 4.6.1`	`4.6.1`
mercurial mercurial	`< 4.6.1`	`4.6.1`

Description

The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

NVD description

The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

References

nvd.nist.gov/vuln/detail/CVE-2018-13346 · ADVISORY
access.redhat.com/errata/RHSA-2019:2276 · WEB
pypa/advisory-database · WEB
lists.debian.org/debian-lts-announce/2020/07/msg00032.html · WEB
mercurial-scm.org/repo/hg/rev/faa924469635 · WEB
mercurial-scm.org/wiki/WhatsNew · WEB
GitHub Advisory GHSA-9xv4-r2hf-26gh · ADVISORY

More vulnerabilities in mercurial

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mercurial

PyPI

< 4.6.1

4.6.1

mercurial

< 4.6.1

4.6.1

Description

The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

NVD description

The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.

More vulnerabilities in mercurial

See all →