[Git][security-tracker-team/security-tracker][master] more than meets the eye in mercurial

[Antoine Beaupré]

Antoine Beaupré pushed to branch master at Debian Security Tracker / security-tracker


Commits:
379c2521 by Antoine Beaupré at 2018-07-05T11:59:35-04:00
more than meets the eye in mercurial

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -3070,6 +3070,8 @@ CVE-2018-XXXX [OVE-20180430-0002: mpatch: protect against underflow in mpatch_ap
 	- mercurial 4.6.1-1 (bug #901050)
 	NOTE: https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
 	NOTE: https://www.mercurial-scm.org/repo/hg/rev/1acfc35d478c
+	NOTE: there are actually 6 more patches required to completely fix bug #901050, see https://www.mercurial-scm.org/repo/hg-committed/log?rev=modifies%28%22mercurial%2Fmpatch.c%22%29+and+4.5%3A%3A
+	NOTE: upstream proposes we use OVE-20180430-0002 to cover all undefined behavior cases which the 6 patches fix
 CVE-2018-XXXX [OVE-20180430-0001: mpatch: be more careful about parsing binary patch data]
 	- mercurial 4.6.1-1 (bug #901050)
 	NOTE: https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/379c2521d412e6d3b94701b58fb8fde6b57db14c

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/commit/379c2521d412e6d3b94701b58fb8fde6b57db14c
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20180705/0a6ec0dc/attachment.html>