Bug 658712 (CVE-2018-13346, CVE-2018-13347, CVE-2018-13348) – <dev-vcs/mercurial-4.6.1: multiple vulnerabilities

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Florian Schuhmacher 2018-06-22 04:59:04 UTC]

For tracking purposes: mercurial 4.6.1 contains security fixes as
denoted in: 

https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29


1.1. Security Fixes

Multiple issues found in mpatch.c with a fuzzer:

    OVE-20180430-0001
    OVE-20180430-0002
    OVE-20180430-0004 

With the following fixes:

    mpatch: be more careful about parsing binary patch data (SEC)
    mpatch: protect against underflow in mpatch_apply (SEC)
    mpatch: ensure fragment start isn't past the end of orig (SEC)
    mpatch: fix UB in int overflows in gather() (SEC)
    mpatch: fix UB integer overflows in discard() (SEC)
    mpatch: avoid integer overflow in mpatch_decode (SEC)
    mpatch: avoid integer overflow in combine() (SEC) 

No exploits are known at the time, however, it is highly recommended that all users upgrade. 

No CVEs are yet assigned.

Gentoo Security Scout
Florian Schuhmacher

[Comment 1 Agostino Sarubbo 2018-07-11 14:28:08 UTC]

amd64 stable

[Comment 2 Larry the Git Cow 2018-07-11 21:22:07 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=092f0026101933f10427916cb9c73b90a814c699

commit 092f0026101933f10427916cb9c73b90a814c699
Author:     Rolf Eike Beer <[e-mail]>
AuthorDate: 2018-07-11 17:18:54 +0000
Commit:     Sergei Trofimovich <[e-mail]>
CommitDate: 2018-07-11 21:21:53 +0000

    dev-vcs/mercurial: stable 4.6.2 for sparc
    
    Bug: https://bugs.gentoo.org/658712
    Package-Manager: Portage-2.3.40, Repoman-2.3.9
    RepoMan-Options: --include-arches="sparc"

 dev-vcs/mercurial/mercurial-4.6.2.ebuild | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

[Comment 3 Thomas Deutschmann (RETIRED) 2018-07-15 14:25:13 UTC]

x86 stable

[Comment 4 Tobias Klausmann (RETIRED) 2018-07-20 12:13:09 UTC]

Stable on alpha.

[Comment 5 Mikle Kolyada (RETIRED) 2018-07-22 19:03:20 UTC]

arm stable

[Comment 6 Sergei Trofimovich (RETIRED) 2018-09-01 23:43:49 UTC]

ia64 stable

[Comment 7 Matt Turner 2018-09-17 21:25:55 UTC]

ppc/ppc64 stable. all arches stable

[Comment 8 Aaron Bauman (RETIRED) 2018-11-24 22:57:35 UTC]

Fixes are in 4.6.1.  Maintainer decided to stable 4.6.2. Summary adjusted.

@maintainer, HPPA is not a stable arch... if you would like to proceed with cleanup of 4.5.2.

[Comment 9 Aaron Bauman (RETIRED) 2019-03-10 04:10:56 UTC]

please clean.

[Comment 10 Yury German 2019-04-17 04:21:22 UTC]

Maintainer(s), please drop the vulnerable version(s).

[Comment 11 Larry the Git Cow 2019-04-17 08:16:30 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=a3a686e12d8c35676f4dec2250d66bc42ef70796

commit a3a686e12d8c35676f4dec2250d66bc42ef70796
Author:     Lars Wendler <[e-mail]>
AuthorDate: 2019-04-17 08:12:17 +0000
Commit:     Lars Wendler <[e-mail]>
CommitDate: 2019-04-17 08:12:17 +0000

    dev-vcs/mercurial: Security cleanup
    
    Bug: https://bugs.gentoo.org/658712
    Package-Manager: Portage-2.3.63, Repoman-2.3.12
    Signed-off-by: Lars Wendler <[e-mail]>

 dev-vcs/mercurial/Manifest               |   3 -
 dev-vcs/mercurial/mercurial-4.5.2.ebuild | 137 ----------------------------
 dev-vcs/mercurial/mercurial-4.7.1.ebuild | 136 ----------------------------
 dev-vcs/mercurial/mercurial-4.8.2.ebuild | 148 -------------------------------
 4 files changed, 424 deletions(-)