Browse CVEs

MEDIUM 5.9 CVE-2010-4237 Mercurial before 1.6.4 fails to verify the Common Name field of SSL certificates which allows remote attackers who acquire a certificate signed by a … Mercurial 1.6.4+ Fix from $1,6002019-10-29 CRITICAL 9.1 CVE-2018-17983 cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry. Mercurial 4.7.2+ Fix from $2,3002018-10-04 CRITICAL 9.8 CVE-2018-13347 mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002. Mercurial 4.6.1+ Fix from $2,3002018-07-06 HIGH 7.5 CVE-2018-13346 The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the origina… Mercurial 4.6.1+ Fix from $1,9502018-07-06 HIGH 7.5 CVE-2018-13348 The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining afte… Mercurial 4.6.1+ Fix from $1,9502018-07-06 MEDIUM 5.0 CVE-2008-4297 Mercurial before 1.0.2 does not enforce the allowpull permission setting for a pull operation from hgweb, which allows remote attackers to read arbit… Mercurial after 1.0.1 Fix from $1,6002008-09-27 MEDIUM 6.8 CVE-2008-2942 Directory traversal vulnerability in patch.py in Mercurial 1.0.1 allows user-assisted attackers to modify arbitrary files via ".." (dot dot) sequence… Mercurial No fix yet Fix from $1,6002008-06-30