CVE-2018-17983
First published: Thu Oct 04 2018(Updated: )
`cext/manifest.c` in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mercurial Mercurial | <4.7.2 | |
| pip/mercurial | <4.7.2 | 4.7.2 |
| debian/mercurial | 5.6.1-4 6.3.2-1 6.8.2-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.mercurial-scm.org/repo/hg/rev/5405cb1a7901
- https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.7.2_.282018-10-01.29
- https://nvd.nist.gov/vuln/detail/CVE-2018-17983
- https://github.com/advisories/GHSA-p575-cf9h-wv42 (Advisory)
- https://launchpad.net/bugs/cve/CVE-2018-17983
- https://security-tracker.debian.org/tracker/CVE-2018-17983
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17983
- https://ubuntu.com/security/CVE-2018-17983
- https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-91.yaml
Frequently Asked Questions
What is the vulnerability ID for the Mercurial out-of-bounds read vulnerability?
The vulnerability ID for the Mercurial out-of-bounds read vulnerability is CVE-2018-17983.
What is the severity rating of CVE-2018-17983?
CVE-2018-17983 has a severity rating of 9.1, which is considered critical.
What is the affected software?
The affected software is Mercurial before version 4.7.2.
What is the CWE ID for this vulnerability?
The CWE ID for this vulnerability is CWE-125.
How can I fix the Mercurial out-of-bounds read vulnerability?
To fix the Mercurial out-of-bounds read vulnerability, you should update to version 4.7.2 or later.
- collector/nvd-index
- agent/type
- agent/remedy
- agent/weakness
- agent/author
- agent/severity
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- collector/github-advisory
- source/GitHub
- alias/GHSA-p575-cf9h-wv42
- alias/CVE-2018-17983
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/tags
- agent/softwarecombine
- agent/event
- agent/description
- collector/github-advisory-latest
- vendor/mercurial
- canonical/mercurial mercurial
- package-manager/pip
- package-manager/debian