Security update for mercurial SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:1990-1 Final 1 1 2018-07-19T08:01:07Z current 2018-07-19T08:01:07Z 2018-07-19T08:01:07Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for mercurial This update for mercurial fixes the following issues: Security issues fixed: - CVE-2018-13346: Fix mpatch_apply function in mpatch.c that incorrectly proceeds in cases where the fragment start is past the end of the original data (bsc#1100354). - CVE-2018-13347: Fix mpatch.c that mishandles integer addition and subtraction (bsc#1100355). - CVE-2018-13348: Fix the mpatch_decode function in mpatch.c that mishandles certain situations where there should be at least 12 bytes remaining after thecurrent position in the patch data (bsc#1100353). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-SLE-SDK-12-SP3-2018-1356 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20181990-1/ Link for SUSE-SU-2018:1990-1 https://lists.suse.com/pipermail/sle-security-updates/2018-July/004284.html E-Mail link for SUSE-SU-2018:1990-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1100353 SUSE Bug 1100353 https://bugzilla.suse.com/1100354 SUSE Bug 1100354 https://bugzilla.suse.com/1100355 SUSE Bug 1100355 https://www.suse.com/security/cve/CVE-2018-13346/ SUSE CVE CVE-2018-13346 page https://www.suse.com/security/cve/CVE-2018-13347/ SUSE CVE CVE-2018-13347 page https://www.suse.com/security/cve/CVE-2018-13348/ SUSE CVE CVE-2018-13348 page SUSE Linux Enterprise Software Development Kit 12 SP3 mercurial-2.8.2-15.13.1 mercurial-2.8.2-15.13.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004. CVE-2018-13346 SUSE Linux Enterprise Software Development Kit 12 SP3:mercurial-2.8.2-15.13.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181990-1/ https://www.suse.com/security/cve/CVE-2018-13346.html CVE-2018-13346 https://bugzilla.suse.com/1100354 SUSE Bug 1100354 mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002. CVE-2018-13347 SUSE Linux Enterprise Software Development Kit 12 SP3:mercurial-2.8.2-15.13.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181990-1/ https://www.suse.com/security/cve/CVE-2018-13347.html CVE-2018-13347 https://bugzilla.suse.com/1100355 SUSE Bug 1100355 The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001. CVE-2018-13348 SUSE Linux Enterprise Software Development Kit 12 SP3:mercurial-2.8.2-15.13.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20181990-1/ https://www.suse.com/security/cve/CVE-2018-13348.html CVE-2018-13348 https://bugzilla.suse.com/1100353 SUSE Bug 1100353