A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade librhsm | May 4, 2022 | Mar 27, 2019 |
| Centos_linux | — | Upgrade libdnf-debuginfoUpgrade createrepo_c-libsUpgrade libcomps-debugsourceUpgrade libcomps-debuginfoUpgrade microdnf-debuginfoUpgrade python3-solv-debuginfoUpgrade createrepo_c-libs-debuginfoUpgrade createrepo_c-debugsourceUpgrade libsolv-demo-debuginfoUpgrade libsolv-debugsourceUpgrade python-libcomps-docUpgrade python2-libcompsUpgrade python3-dnfUpgrade python3-libcomps-debuginfoUpgrade python3-librepo-debuginfoUpgrade dnf-plugins-coreUpgrade python3-createrepo_c-debuginfoUpgrade dnfUpgrade librhsm-debugsourceUpgrade python3-libcompsUpgrade libcomps-docUpgrade libcompsUpgrade libcomps-develUpgrade yumUpgrade microdnfUpgrade python3-libdnfUpgrade python3-hawkeyUpgrade libdnf-debugsourceUpgrade createrepo_cUpgrade libsolvUpgrade createrepo_c-develUpgrade createrepo_c-debuginfoUpgrade librepoUpgrade libdnfUpgrade libsolv-debuginfoUpgrade librepo-debugsourceUpgrade python3-dnf-plugins-coreUpgrade python3-dnf-plugin-versionlockUpgrade python3-libdnf-debuginfoUpgrade perl-solv-debuginfoUpgrade librhsmUpgrade python3-hawkey-debuginfoUpgrade librepo-debuginfoUpgrade librhsm-debuginfoUpgrade ruby-solv-debuginfoUpgrade python3-librepoUpgrade dnf-dataUpgrade microdnf-debugsourceUpgrade libsolv-tools-debuginfoUpgrade dnf-automaticUpgrade python3-createrepo_cUpgrade yum-utils | Nov 6, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-libcompsUpgrade libcomps-develUpgrade libcompsUpgrade python2-libcomps | Mar 24, 2020 | Mar 27, 2019 |
| Oracle_linux | — | Upgrade librepoUpgrade dnfUpgrade libdnfUpgrade python3-dnfUpgrade python3-hawkeyUpgrade python3-libcompsUpgrade python3-createrepo_cUpgrade python3-libdnfUpgrade dnf-dataUpgrade microdnfUpgrade createrepo_c-develUpgrade python3-dnf-plugin-versionlockUpgrade libcomps-develUpgrade dnf-automaticUpgrade yum-utilsUpgrade librhsmUpgrade python3-dnf-plugins-coreUpgrade python3-librepoUpgrade libcompsUpgrade createrepo_c-libsUpgrade libsolvUpgrade dnf-plugins-coreUpgrade yumUpgrade createrepo_c | Oct 5, 2022 | Jan 21, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade python3-dnfUpgrade microdnfUpgrade librhsm-debuginfoUpgrade python3-dnf-plugin-versionlockUpgrade microdnf-debuginfoUpgrade createrepo_c-debugsourceUpgrade python3-solv-debuginfoUpgrade libcompsUpgrade librepo-debuginfoUpgrade python3-libdnf-debuginfoUpgrade librepo-debugsourceUpgrade python3-libcomps-debuginfoUpgrade python3-libdnfUpgrade python3-createrepo_c-debuginfoUpgrade libcomps-develUpgrade librepoUpgrade dnf-plugins-coreUpgrade createrepo_c-libs-debuginfoUpgrade libdnf-debuginfoUpgrade perl-solv-debuginfoUpgrade librhsm-debugsourceUpgrade dnfUpgrade librhsmUpgrade libdnf-debugsourceUpgrade ruby-solv-debuginfoUpgrade libdnfUpgrade python3-librepo-debuginfoUpgrade libcomps-debugsourceUpgrade libcomps-debuginfoUpgrade python3-dnf-plugins-coreUpgrade dnf-dataUpgrade libsolvUpgrade python3-hawkeyUpgrade yum-utilsUpgrade libsolv-tools-debuginfoUpgrade yumUpgrade libsolv-debugsourceUpgrade microdnf-debugsourceUpgrade createrepo_c-libsUpgrade python3-librepoUpgrade dnf-automaticUpgrade libsolv-debuginfoUpgrade createrepo_cUpgrade python3-hawkey-debuginfoUpgrade python3-createrepo_cUpgrade createrepo_c-debuginfoUpgrade createrepo_c-develUpgrade libsolv-demo-debuginfoUpgrade python3-libcomps | Nov 6, 2019 | Mar 27, 2019 |
| Suse | — | Upgrade python3-libcompsUpgrade libcomps0_1_6Upgrade python-libcomps-docUpgrade libcomps-develUpgrade python2-libcompsUpgrade libcomps-doc | Mar 12, 2019 | Mar 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub