Red Hat Security AdvisoryRHSA-2019:2276
mercurial security update
Released 2019-08-06 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) emacs-mercurial-2.6.2-10.el7, emacs-mercurial-el-2.6.2-10.el7, mercurial-2.6.2-10.el7 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) emacs-mercurial-2.6.2-10.el7, emacs-mercurial-el-2.6.2-10.el7, mercurial-2.6.2-10.el7 +1
- Red Hat Enterprise Linux Server (v. 7) mercurial-2.6.2-10.el7
- Red Hat Enterprise Linux Server Optional (v. 7) emacs-mercurial-2.6.2-10.el7, emacs-mercurial-el-2.6.2-10.el7, mercurial-hgk-2.6.2-10.el7
- Red Hat Enterprise Linux Workstation (v. 7) mercurial-2.6.2-10.el7
- Red Hat Enterprise Linux Workstation Optional (v. 7) emacs-mercurial-2.6.2-10.el7, emacs-mercurial-el-2.6.2-10.el7, mercurial-hgk-2.6.2-10.el7
Fixes 3 records
Priority MEDIUM 47
mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02717 · Published 2018-07-06 · Partial fix · 4.6.1 CWE-190
Priority MEDIUM 44
Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access.
CVSS 3.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02668 · Published 2018-03-14 · Partial fix · 4.5.1 CWE-732
Priority LOW 37
The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02402 · Published 2018-07-06 · Partial fix · 4.6.1 CWE-20
THREATIST.IORead the docs