A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade librhsm | May 4, 2022 | Mar 27, 2019 |
| Centos_linux | — | Upgrade python3-createrepo_cUpgrade python3-librepoUpgrade libdnf-debugsourceUpgrade microdnf-debugsourceUpgrade yum-utilsUpgrade libsolv-debuginfoUpgrade dnf-dataUpgrade createrepo_c-debuginfoUpgrade python3-libdnf-debuginfoUpgrade python3-hawkey-debuginfoUpgrade librhsmUpgrade librhsm-debuginfoUpgrade createrepo_cUpgrade perl-solv-debuginfoUpgrade python3-hawkeyUpgrade python3-dnf-plugins-coreUpgrade librepoUpgrade ruby-solv-debuginfoUpgrade libdnfUpgrade createrepo_c-develUpgrade librepo-debuginfoUpgrade python3-dnf-plugin-versionlockUpgrade librepo-debugsourceUpgrade dnf-automaticUpgrade libsolvUpgrade libsolv-tools-debuginfoUpgrade python3-libcomps-debuginfoUpgrade python2-libcompsUpgrade python3-libcompsUpgrade yumUpgrade dnf-plugins-coreUpgrade libsolv-debugsourceUpgrade libsolv-demo-debuginfoUpgrade python3-libdnfUpgrade python3-librepo-debuginfoUpgrade python3-dnfUpgrade libcomps-docUpgrade python3-solv-debuginfoUpgrade createrepo_c-debugsourceUpgrade createrepo_c-libs-debuginfoUpgrade microdnf-debuginfoUpgrade createrepo_c-libsUpgrade python-libcomps-docUpgrade libdnf-debuginfoUpgrade libcomps-debugsourceUpgrade librhsm-debugsourceUpgrade libcomps-develUpgrade dnfUpgrade libcomps-debuginfoUpgrade libcompsUpgrade microdnfUpgrade python3-createrepo_c-debuginfo | Nov 6, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-libcompsUpgrade libcompsUpgrade libcomps-develUpgrade python3-libcomps | Mar 24, 2020 | Mar 27, 2019 |
| Oracle_linux | — | Upgrade createrepo_c-develUpgrade dnfUpgrade python3-libdnfUpgrade python3-libcompsUpgrade python3-dnfUpgrade dnf-dataUpgrade python3-createrepo_cUpgrade microdnfUpgrade libdnfUpgrade python3-hawkeyUpgrade python3-dnf-plugin-versionlockUpgrade librepoUpgrade libsolvUpgrade createrepo_c-libsUpgrade dnf-plugins-coreUpgrade librhsmUpgrade libcomps-develUpgrade python3-dnf-plugins-coreUpgrade yum-utilsUpgrade libcompsUpgrade dnf-automaticUpgrade python3-librepoUpgrade yumUpgrade createrepo_c | Oct 5, 2022 | Jan 21, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade python3-solv-debuginfoUpgrade librhsm-debuginfoUpgrade microdnf-debuginfoUpgrade createrepo_c-libs-debuginfoUpgrade libcomps-debuginfoUpgrade libcomps-develUpgrade librepo-debuginfoUpgrade librhsmUpgrade python3-dnfUpgrade libcompsUpgrade dnf-plugins-coreUpgrade python3-libdnfUpgrade libdnf-debugsourceUpgrade python3-librepo-debuginfoUpgrade librhsm-debugsourceUpgrade libdnfUpgrade python3-dnf-plugin-versionlockUpgrade python3-libcomps-debuginfoUpgrade ruby-solv-debuginfoUpgrade createrepo_c-debugsourceUpgrade libdnf-debuginfoUpgrade perl-solv-debuginfoUpgrade librepo-debugsourceUpgrade python3-libdnf-debuginfoUpgrade microdnfUpgrade dnfUpgrade libcomps-debugsourceUpgrade python3-createrepo_c-debuginfoUpgrade librepoUpgrade createrepo_c-develUpgrade createrepo_c-debuginfoUpgrade dnf-automaticUpgrade python3-hawkeyUpgrade microdnf-debugsourceUpgrade createrepo_cUpgrade yumUpgrade python3-librepoUpgrade libsolv-debuginfoUpgrade yum-utilsUpgrade createrepo_c-libsUpgrade python3-dnf-plugins-coreUpgrade libsolv-tools-debuginfoUpgrade dnf-dataUpgrade python3-hawkey-debuginfoUpgrade python3-createrepo_cUpgrade libsolv-debugsourceUpgrade libsolvUpgrade python3-libcompsUpgrade libsolv-demo-debuginfo | Nov 6, 2019 | Mar 27, 2019 |
| Suse | — | Upgrade libcomps0_1_6Upgrade python3-libcompsUpgrade python-libcomps-docUpgrade libcomps-docUpgrade libcomps-develUpgrade python2-libcomps | Mar 12, 2019 | Mar 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub