SUSE-SU-2018:1990-1: moderate: Security update for mercurial

sle-security-updates at sle-security-updates at
Thu Jul 19 07:10:49 MDT 2018

   SUSE Security Update: Security update for mercurial

Announcement ID:    SUSE-SU-2018:1990-1
Rating:             moderate
References:         #1100353 #1100354 #1100355 
Cross-References:   CVE-2018-13346 CVE-2018-13347 CVE-2018-13348
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 12-SP3

   An update that fixes three vulnerabilities is now available.


   This update for mercurial fixes the following issues:

   Security issues fixed:

   - CVE-2018-13346: Fix mpatch_apply function in mpatch.c that incorrectly
     proceeds in cases where the fragment start is past the end of the
     original data (bsc#1100354).
   - CVE-2018-13347: Fix mpatch.c that mishandles integer addition and
     subtraction (bsc#1100355).
   - CVE-2018-13348: Fix the mpatch_decode function in mpatch.c that
     mishandles certain situations where there should be at least 12 bytes
     remaining after thecurrent position in the patch data (bsc#1100353).

Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 12-SP3:

      zypper in -t patch SUSE-SLE-SDK-12-SP3-2018-1356=1

Package List:

   - SUSE Linux Enterprise Software Development Kit 12-SP3 (aarch64 ppc64le s390x x86_64):



More information about the sle-security-updates mailing list