CVE-2018-13346

Name of the Vulnerable Software and Affected Versions Mercurial versions prior to 4.6.1

Description The issue is related to the mpatch apply function in mpatch.c, which incorrectly proceeds when the fragment start is past the end of the original data. This is due to a lack of input validation. Exploitation of this issue may allow a remote attacker to impact data integrity.

Recommendations For Mercurial versions prior to 4.6.1, update to version 4.6.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of the mpatch apply function until a patch is available.