{"id":"CVE-2018-13348","aliases":["DEBIAN-CVE-2018-13348","DLA-1414-1","DLA-2293-1","EUVD-2018-0097","GHSA-3v62-ww8w-758m","MGASA-2018-0355","PYSEC-2018-90","SUSE-SU-2018:1990-1","SUSE-SU-2018:1996-1","SUSE-SU-2018:1998-1","UBUNTU-CVE-2018-13348","openSUSE-SU-2024:10586-1"],"status":"published","title":"Mercurial Improper Input Validation vulnerability","description":"The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02145,"percentile":0.82189,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-07-05T00:00:00Z","modified":"2026-10-23T18:03:54Z","fixes":[{"ecosystem":"PyPI","package":"mercurial","fixed_in":["4.6.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"mercurial","fixed_in":["4.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mercurial","fixed_in":["4.6.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mercurial","fixed_in":["4.6.1-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"mercurial","fixed_in":["2.8.2-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"mercurial","fixed_in":["3.7.3-1ubuntu1.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"mercurial","fixed_in":["4.5.3-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.2-2+deb8u5"}]}],"versions":["3.1.2-2","3.1.2-2+deb8u1","3.1.2-2+deb8u2","3.1.2-2+deb8u3","3.1.2-2+deb8u4"],"bundled":6},{"source":"osv","ecosystem":"Debian:9","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0-1+deb9u2"}]}],"versions":["4.0-1","4.0-1+deb9u1"],"bundled":6},{"source":"osv","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1"}]}],"versions":["0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.3","1.7.5","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","2.2.2","2.3","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.7.2","2.8","2.8.1","2.8.2","2.9","2.9.1","3.0","3.0.1","3.1","3.1.1","3.1.2","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.3","3.3-rc","3.3.1","3.3.2","3.3.3","3.4","3.4-rc","3.4.1","3.4.2","3.5","3.5-rc","3.5.1","3.5.2","3.6","3.6-rc","3.6.1","3.6.2","3.6.3","3.7","3.7-rc","3.7.1","3.7.2","3.7.3","3.8","3.8-rc","3.8.1","3.8.2","3.8.3","3.8.4","3.9","3.9-rc","3.9.1","3.9.2","4.0","4.0-rc","4.0.1","4.0.2","4.1","4.1-rc","4.1.1","4.1.2","4.1.3","4.2","4.2-rc","4.2.1","4.2.2","4.2.3","4.3","4.3-rc","4.3.1","4.3.2","4.3.3","4.3rc0","4.4","4.4-rc","4.4.1","4.4.2","4.4rc0","4.5","4.5-rc","4.5.1","4.5.2","4.5.3","4.5rc0","4.6","4.6rc0","4.6rc1"]},{"source":"osv","ecosystem":"Mageia:5","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-1.mga5"}]}],"bundled":4},{"source":"osv","ecosystem":"Mageia:6","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-1.mga6"}]}],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.1"}]}],"versions":["0.8.1","0.9","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","1.0","1.0.1","1.0.2","1.1","1.1.1","1.1.2","1.2","1.2.1","1.3","1.3.1","1.4","1.4.1","1.4.2","1.4.3","1.5","1.5.1","1.5.2","1.5.3","1.5.4","1.6","1.6.1","1.6.2","1.6.3","1.6.4","1.7","1.7.1","1.7.2","1.7.3","1.7.5","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.9","1.9.1","1.9.2","1.9.3","2.0","2.0.1","2.0.2","2.1","2.1.1","2.1.2","2.2","2.2.2","2.3","2.4.1","2.5","2.5.1","2.5.2","2.6","2.6.1","2.6.2","2.6.3","2.7.0","2.7.1","2.7.2","2.8","2.8.1","2.8.2","2.9","2.9.1","3.0","3.0.1","3.1","3.1.1","3.1.2","3.2","3.2.1","3.2.2","3.2.3","3.2.4","3.3","3.3-rc","3.3.1","3.3.2","3.3.3","3.4","3.4-rc","3.4.1","3.4.2","3.5","3.5-rc","3.5.1","3.5.2","3.6","3.6-rc","3.6.1","3.6.2","3.6.3","3.7","3.7-rc","3.7.1","3.7.2","3.7.3","3.8","3.8-rc","3.8.1","3.8.2","3.8.3","3.8.4","3.9","3.9-rc","3.9.1","3.9.2","4.0","4.0-rc","4.0.1","4.0.2","4.1","4.1-rc","4.1.1","4.1.2","4.1.3","4.2","4.2-rc","4.2.1","4.2.2","4.2.3","4.3","4.3-rc","4.3.1","4.3.2","4.3.3","4.3rc0","4.4","4.4-rc","4.4.1","4.4.2","4.4rc0","4.5","4.5-rc","4.5.1","4.5.2","4.5.3","4.5rc0","4.6","4.6rc0","4.6rc1"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-15.13.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-0.18.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.2-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.2-1ubuntu1.4"}]}],"versions":["2.6.3-1","2.7.2-1","2.8.1-2","2.8.2-1ubuntu1","2.8.2-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.7.3-1ubuntu1.1"}]}],"versions":["3.4-1ubuntu2","3.6.2-1ubuntu2","3.7.3-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.5.3-1ubuntu2.1"}]}],"versions":["4.3.1-2","4.5-1ubuntu1","4.5.2-0ubuntu2","4.5.3-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mercurial","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.1-2.1"}]}],"bundled":9}],"products":[{"vendor":"mercurial","product":"mercurial"}],"references":[{"url":"https://www.mercurial-scm.org/repo/hg/rev/90a274965de7","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","fix","web","report"]},{"url":"https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-13348","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-90.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-3v62-ww8w-758m","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-13348","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0355.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22895","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-04/msg00021.html","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2018-07/msg00057.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181990-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1100353","tags":["report"]},{"url":"https://bugzilla.suse.com/1100354","tags":["report"]},{"url":"https://bugzilla.suse.com/1100355","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13346","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13347","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-13348","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181996-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181998-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-13348","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-13348","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2008-2942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000115","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000116","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-17458","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1000132","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-17983","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3902","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-13348","description":"The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.","status":"published","published":"2018-07-06T00:00:00Z","modified":"2024-08-05T09:00:35.14Z","updated_at":"2026-11-02T14:35:07.354449Z"}],"euvd":[{"id":"EUVD-2018-0097","description":"The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.","status":"published","published":"2018-07-06T00:00:00Z","modified":"2024-08-05T09:00:35Z","updated_at":"2026-11-03T02:39:50.070155Z"}],"ghsa":[{"id":"GHSA-3v62-ww8w-758m","title":"Mercurial Improper Input Validation vulnerability","description":"The `mpatch_decode` function in `mpatch.c` in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.","status":"published","published":"2022-05-13T01:24:55Z","modified":"2024-09-25T17:16:49Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:06.29677Z"}],"nvd":[{"id":"CVE-2018-13348","description":"The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.","status":"published","published":"2018-07-06T00:29:00.343Z","modified":"2026-06-17T01:39:15.18Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:31.362791Z"}],"osv":[{"id":"CVE-2018-13348","description":"The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.","status":"published","published":"2018-07-06T00:29:00.343Z","modified":"2026-04-16T06:19:27.982237687Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:08.242347Z"},{"id":"DEBIAN-CVE-2018-13348","description":"The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.","status":"published","published":"2018-07-06T00:29:00.343Z","modified":"2026-10-23T18:03:54.55497018Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:30.290351Z"},{"id":"GHSA-3v62-ww8w-758m","title":"Mercurial Improper Input Validation vulnerability","description":"The `mpatch_decode` function in `mpatch.c` in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.","status":"published","published":"2022-05-13T01:24:55Z","modified":"2024-09-25T17:23:41.207908Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:36.092962Z"},{"id":"UBUNTU-CVE-2018-13348","description":"The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.","status":"published","published":"2018-07-06T00:29:00Z","modified":"2025-09-08T16:44:57Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:17.014176Z"},{"id":"DLA-1414-1","title":"mercurial - security update","status":"published","published":"2018-07-05T00:00:00Z","modified":"2026-03-09T01:00:49.655825Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DLA-2293-1","title":"mercurial - security update","status":"published","published":"2020-07-27T00:00:00Z","modified":"2026-03-09T01:23:33.131746Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2018-0355","title":"Updated mercurial packages fix security vulnerabilities","description":"This update provides mercurial version 4.6.2 and fixes the following\nsecurity issues:\n\nFix the mpatch_apply function in mpatch.c that incorrectly proceeds in\ncases where the fragment start is past the end of the original data\n(CVE-2018-13346).\n\nFix mpatch.c that mishandles integer addition and subtraction\n(CVE-2018-13347).\n\nFix the mpatch_decode function in mpatch.c that mishandles certain\nsituations where there should be at least 12 bytes remaining after\nthe current position in the patch data (CVE-2018-13348).\n\nRemote attackers may bypass HTTP server permissions via batch wire\nprotocol commands(CVE-2018-1000132).\n","status":"published","published":"2018-08-31T21:11:59Z","modified":"2026-04-16T06:24:06.56638677Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:10586-1","title":"mercurial-5.9.1-2.1 on GA media","description":"These are all security issues fixed in the mercurial-5.9.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:48:28.818841Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"PYSEC-2018-90","description":"The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.","status":"published","published":"2018-07-06T00:29:00Z","modified":"2026-06-10T17:01:23.820638096Z","updated_at":"2026-11-02T15:52:52.192131Z"},{"id":"SUSE-SU-2018:1990-1","title":"Security update for mercurial","description":"This update for mercurial fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-13346: Fix mpatch_apply function in mpatch.c that incorrectly proceeds in cases where the fragment start is past the end of the original data (bsc#1100354).\n- CVE-2018-13347: Fix mpatch.c that mishandles integer addition and subtraction (bsc#1100355).\n- CVE-2018-13348: Fix the mpatch_decode function in mpatch.c that mishandles certain situations where there should be at least 12 bytes remaining after thecurrent position in the patch data (bsc#1100353).\n","status":"published","published":"2018-07-19T08:01:07Z","modified":"2026-02-04T02:31:46.661574Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1996-1","title":"Security update for mercurial","description":"This update for mercurial fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-13346: Fix mpatch_apply function in mpatch.c that incorrectly proceeds in cases where the fragment start is past the end of the original data (bsc#1100354).\n- CVE-2018-13347: Fix mpatch.c that mishandles integer addition and subtraction (bsc#1100355).\n- CVE-2018-13348: Fix the mpatch_decode function in mpatch.c that mishandles certain situations where there should be at least 12 bytes remaining after thecurrent position in the patch data (bsc#1100353).\n","status":"published","published":"2018-07-19T08:04:49Z","modified":"2026-02-04T02:37:25.009709Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1998-1","title":"Security update for mercurial","description":"This update for mercurial fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2018-13346: Fix mpatch_apply function in mpatch.c that incorrectly proceeds in cases where the fragment start is past the end of the original data (bsc#1100354).\n- CVE-2018-13347: Fix mpatch.c that mishandles integer addition and subtraction (bsc#1100355).\n- CVE-2018-13348: Fix the mpatch_decode function in mpatch.c that mishandles certain situations where there should be at least 12 bytes remaining after thecurrent position in the patch data (bsc#1100353).\n","status":"published","published":"2018-07-19T07:57:38Z","modified":"2026-02-04T03:17:23.731135Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}