CVE-2018-13348

{"id": "CVE-2018-13348", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2018-07-06T00:29:00.343", "references": [{"url": "https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html", "source": "cve@mitre.org"}, {"url": "https://www.mercurial-scm.org/repo/hg/rev/90a274965de7", "tags": ["Vendor Advisory", "Patch"], "source": "cve@mitre.org"}, {"url": "https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001."}, {"lang": "es", "value": "La funci\u00f3n mpatch_decode en mpatch.c en Mercurial en versiones anteriores a la 4.6.1 gestiona de manera incorrecta ciertas situaciones en las que deber\u00eda haber, al menos, 12 bytes sobrantes tras la posici\u00f3n actual en los datos del parche, pero en realidad no los hay. Esto tambi\u00e9n se conoce como OVE-20180430-0001."}], "lastModified": "2020-07-31T13:15:12.007", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mercurial:mercurial:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F4BEEE0C-8510-41B6-8001-31DE409934BB", "versionEndExcluding": "4.6.1"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}