MGASA-2018-0355 - Updated mercurial packages fix security vulnerabilities

Publication date: 31 Aug 2018
URL: https://advisories.mageia.org/MGASA-2018-0355.html
Type: security
Affected Mageia releases: 5, 6
CVE: CVE-2018-13346,
     CVE-2018-13347,
     CVE-2018-13348,
     CVE-2018-1000132

This update provides mercurial version 4.6.2 and fixes the following
security issues:

Fix the mpatch_apply function in mpatch.c that incorrectly proceeds in
cases where the fragment start is past the end of the original data
(CVE-2018-13346).

Fix mpatch.c that mishandles integer addition and subtraction
(CVE-2018-13347).

Fix the mpatch_decode function in mpatch.c that mishandles certain
situations where there should be at least 12 bytes remaining after
the current position in the patch data (CVE-2018-13348).

Remote attackers may bypass HTTP server permissions via batch wire
protocol commands(CVE-2018-1000132).

References:
- https://bugs.mageia.org/show_bug.cgi?id=22895
- - - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13346
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13347
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-13348
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000132

SRPMS:
- 6/core/mercurial-4.6.2-1.mga6
- 5/core/mercurial-4.6.2-1.mga5