What is CVE-2018-13348?

CVE-2018-13348 is a high-severity vulnerability in Mercurial, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2018-07-06.

How severe is CVE-2018-13348?

High severity. CVSS v3 base score is 7.5 out of 10.

Improper input validation in Mercurial

CVE-2018-13348

The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.

Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)

EPSS: 0.021 (79.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N.

Affected products

Mercurial
N/a — versions n/a

Weakness classification (CWE)

CWE-20 — Improper Input Validation

References

cve@mitre.org (Patch, x_refsource_MISC, Vendor Advisory)
cve@mitre.org (x_refsource_MISC, Vendor Advisory)
cve@mitre.org (mailing-list, x_refsource_MLIST)

Frequently asked questions

What is CVE-2018-13348?: CVE-2018-13348 is a high-severity vulnerability in Mercurial, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2018-07-06.
How severe is CVE-2018-13348?: High severity. CVSS v3 base score is 7.5 out of 10.