A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade librhsm | May 4, 2022 | Mar 27, 2019 |
| Centos_linux | — | Upgrade libdnf-debuginfoUpgrade python3-solv-debuginfoUpgrade createrepo_c-libsUpgrade python3-createrepo_c-debuginfoUpgrade createrepo_c-debugsourceUpgrade libcomps-develUpgrade yumUpgrade python3-librepo-debuginfoUpgrade libcompsUpgrade libcomps-debuginfoUpgrade python3-libdnfUpgrade python2-libcompsUpgrade python-libcomps-docUpgrade libsolv-debugsourceUpgrade microdnfUpgrade dnf-plugins-coreUpgrade python3-dnfUpgrade libcomps-debugsourceUpgrade libsolv-demo-debuginfoUpgrade python3-libcomps-debuginfoUpgrade createrepo_c-libs-debuginfoUpgrade python3-libcompsUpgrade librhsm-debugsourceUpgrade libcomps-docUpgrade dnfUpgrade microdnf-debuginfoUpgrade createrepo_c-develUpgrade dnf-dataUpgrade python3-hawkeyUpgrade librhsmUpgrade python3-hawkey-debuginfoUpgrade python3-libdnf-debuginfoUpgrade ruby-solv-debuginfoUpgrade perl-solv-debuginfoUpgrade librepo-debugsourceUpgrade libsolvUpgrade librepo-debuginfoUpgrade librhsm-debuginfoUpgrade libsolv-tools-debuginfoUpgrade libdnf-debugsourceUpgrade python3-dnf-plugins-coreUpgrade createrepo_c-debuginfoUpgrade createrepo_cUpgrade python3-librepoUpgrade python3-createrepo_cUpgrade yum-utilsUpgrade microdnf-debugsourceUpgrade dnf-automaticUpgrade python3-dnf-plugin-versionlockUpgrade libsolv-debuginfoUpgrade libdnfUpgrade librepo | Nov 6, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-libcompsUpgrade libcomps-develUpgrade python3-libcompsUpgrade libcomps | Mar 24, 2020 | Mar 27, 2019 |
| Oracle_linux | — | Upgrade python3-librepoUpgrade libcompsUpgrade dnf-plugins-coreUpgrade createrepo_c-libsUpgrade python3-dnf-plugins-coreUpgrade createrepo_cUpgrade libsolvUpgrade yum-utilsUpgrade librhsmUpgrade yumUpgrade dnf-automaticUpgrade libcomps-develUpgrade librepoUpgrade createrepo_c-develUpgrade dnf-dataUpgrade python3-libdnfUpgrade python3-hawkeyUpgrade python3-dnf-plugin-versionlockUpgrade python3-libcompsUpgrade python3-dnfUpgrade python3-createrepo_cUpgrade microdnfUpgrade libdnfUpgrade dnf | Oct 5, 2022 | Jan 21, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade dnf-automaticUpgrade libsolvUpgrade libsolv-debuginfoUpgrade yumUpgrade createrepo_c-debuginfoUpgrade yum-utilsUpgrade python3-librepoUpgrade createrepo_c-libsUpgrade libsolv-demo-debuginfoUpgrade python3-createrepo_cUpgrade python3-libcompsUpgrade createrepo_c-develUpgrade dnf-dataUpgrade python3-dnf-plugins-coreUpgrade python3-hawkey-debuginfoUpgrade libsolv-debugsourceUpgrade libsolv-tools-debuginfoUpgrade createrepo_cUpgrade microdnf-debugsourceUpgrade python3-hawkeyUpgrade libcomps-develUpgrade python3-solv-debuginfoUpgrade librepoUpgrade libcompsUpgrade python3-createrepo_c-debuginfoUpgrade libdnf-debugsourceUpgrade perl-solv-debuginfoUpgrade dnf-plugins-coreUpgrade librhsm-debugsourceUpgrade python3-libcomps-debuginfoUpgrade createrepo_c-libs-debuginfoUpgrade microdnf-debuginfoUpgrade librhsmUpgrade librepo-debuginfoUpgrade python3-libdnfUpgrade python3-dnfUpgrade libcomps-debugsourceUpgrade libdnfUpgrade createrepo_c-debugsourceUpgrade dnfUpgrade ruby-solv-debuginfoUpgrade librhsm-debuginfoUpgrade microdnfUpgrade librepo-debugsourceUpgrade python3-libdnf-debuginfoUpgrade libdnf-debuginfoUpgrade libcomps-debuginfoUpgrade python3-dnf-plugin-versionlockUpgrade python3-librepo-debuginfo | Nov 6, 2019 | Mar 27, 2019 |
| Suse | — | Upgrade libcomps0_1_6Upgrade python3-libcompsUpgrade python2-libcompsUpgrade python-libcomps-docUpgrade libcomps-develUpgrade libcomps-doc | Mar 12, 2019 | Mar 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub