A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade librhsm | May 4, 2022 | Mar 27, 2019 |
| Centos_linux | — | Upgrade createrepo_c-develUpgrade ruby-solv-debuginfoUpgrade libsolvUpgrade python3-hawkey-debuginfoUpgrade librhsmUpgrade microdnf-debugsourceUpgrade createrepo_c-debuginfoUpgrade yum-utilsUpgrade python3-hawkeyUpgrade libdnf-debugsourceUpgrade python3-libdnf-debuginfoUpgrade createrepo_cUpgrade libdnfUpgrade librepo-debugsourceUpgrade libsolv-debuginfoUpgrade perl-solv-debuginfoUpgrade libsolv-tools-debuginfoUpgrade librhsm-debuginfoUpgrade python3-dnf-plugins-coreUpgrade librepo-debuginfoUpgrade librepoUpgrade dnf-dataUpgrade python3-createrepo_cUpgrade python3-librepoUpgrade python3-dnf-plugin-versionlockUpgrade dnf-automaticUpgrade python2-libcompsUpgrade libcompsUpgrade libcomps-debugsourceUpgrade libcomps-debuginfoUpgrade python3-libcomps-debuginfoUpgrade python3-librepo-debuginfoUpgrade librhsm-debugsourceUpgrade python3-dnfUpgrade libcomps-develUpgrade dnfUpgrade python3-libcompsUpgrade python-libcomps-docUpgrade createrepo_c-libsUpgrade createrepo_c-libs-debuginfoUpgrade microdnf-debuginfoUpgrade createrepo_c-debugsourceUpgrade python3-solv-debuginfoUpgrade libdnf-debuginfoUpgrade python3-libdnfUpgrade yumUpgrade python3-createrepo_c-debuginfoUpgrade microdnfUpgrade dnf-plugins-coreUpgrade libsolv-demo-debuginfoUpgrade libsolv-debugsourceUpgrade libcomps-doc | Nov 6, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libcompsUpgrade libcomps-develUpgrade python3-libcompsUpgrade python2-libcomps | Mar 24, 2020 | Mar 27, 2019 |
| Oracle_linux | — | Upgrade librepoUpgrade python3-hawkeyUpgrade dnfUpgrade libdnfUpgrade python3-createrepo_cUpgrade python3-dnf-plugin-versionlockUpgrade createrepo_c-develUpgrade microdnfUpgrade python3-libcompsUpgrade python3-dnfUpgrade python3-libdnfUpgrade dnf-dataUpgrade dnf-automaticUpgrade dnf-plugins-coreUpgrade python3-dnf-plugins-coreUpgrade libsolvUpgrade libcomps-develUpgrade yumUpgrade createrepo_cUpgrade createrepo_c-libsUpgrade librhsmUpgrade python3-librepoUpgrade libcompsUpgrade yum-utils | Oct 5, 2022 | Jan 21, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade libdnfUpgrade createrepo_c-debugsourceUpgrade libdnf-debugsourceUpgrade libcomps-debuginfoUpgrade libcompsUpgrade librepoUpgrade microdnf-debuginfoUpgrade python3-libcomps-debuginfoUpgrade perl-solv-debuginfoUpgrade libcomps-develUpgrade python3-solv-debuginfoUpgrade libcomps-debugsourceUpgrade python3-librepo-debuginfoUpgrade createrepo_c-libs-debuginfoUpgrade python3-createrepo_c-debuginfoUpgrade dnfUpgrade ruby-solv-debuginfoUpgrade python3-dnf-plugin-versionlockUpgrade python3-libdnf-debuginfoUpgrade librepo-debugsourceUpgrade python3-libdnfUpgrade librhsmUpgrade libdnf-debuginfoUpgrade librhsm-debuginfoUpgrade python3-dnfUpgrade librhsm-debugsourceUpgrade librepo-debuginfoUpgrade microdnfUpgrade dnf-plugins-coreUpgrade dnf-automaticUpgrade python3-hawkeyUpgrade createrepo_cUpgrade python3-libcompsUpgrade dnf-dataUpgrade python3-hawkey-debuginfoUpgrade createrepo_c-libsUpgrade python3-dnf-plugins-coreUpgrade libsolv-debuginfoUpgrade libsolv-debugsourceUpgrade libsolvUpgrade libsolv-demo-debuginfoUpgrade createrepo_c-develUpgrade createrepo_c-debuginfoUpgrade python3-librepoUpgrade yumUpgrade yum-utilsUpgrade python3-createrepo_cUpgrade libsolv-tools-debuginfoUpgrade microdnf-debugsource | Nov 6, 2019 | Mar 27, 2019 |
| Suse | — | Upgrade python3-libcompsUpgrade libcomps0_1_6Upgrade python2-libcompsUpgrade python-libcomps-docUpgrade libcomps-develUpgrade libcomps-doc | Mar 12, 2019 | Mar 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub