HighFix available
mercurial — security advisory
The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.
- Products
- mercurial
- Affected versions
- Not specified
- Fixed versions
- 4.6.1-1
- CVEs
- CVE-2018-13348
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 00:53 UTC · Revision 1
Source evidence
The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.
osv:DEBIAN-CVE-2018-13348
mercurial
Fixed versions: 4.6.1-1
mercurial
Fixed versions: 4.6.1-1
mercurial
Fixed versions: 4.6.1-1
Complete source record
{
"id": "6e567ec84cda2b6c8526ebd00e607a52ec5247acc7e75c71772c5499255b8fa4",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2018-13348",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2018-13348",
"summary": "The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.",
"evidence": "osv:DEBIAN-CVE-2018-13348",
"products": [
{
"name": {
"value": "mercurial",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.6.1-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mercurial",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.6.1-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mercurial",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "4.6.1-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2018-13348",
"aliases": [
"DEBIAN-CVE-2018-13348"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.1-1"
}
]
}
],
"package": {
"name": "mercurial",
"purl": "pkg:deb/debian/mercurial?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-13348.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.1-1"
}
]
}
],
"package": {
"name": "mercurial",
"purl": "pkg:deb/debian/mercurial?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-13348.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "4.6.1-1"
}
]
}
],
"package": {
"name": "mercurial",
"purl": "pkg:deb/debian/mercurial?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-13348.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-23T18:03:54.554970180Z",
"provider": "osv",
"upstream": [
"CVE-2018-13348"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2018-13348"
]
},
"related_cves": [
{
"value": "CVE-2018-13348",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 422572,
"published_at": "2018-07-06T00:29:00.343+00:00"
}