A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade librhsm | May 4, 2022 | Mar 27, 2019 |
| Centos_linux | — | Upgrade python2-libcompsUpgrade python3-libcompsUpgrade python3-createrepo_c-debuginfoUpgrade dnfUpgrade createrepo_c-libs-debuginfoUpgrade python-libcomps-docUpgrade yumUpgrade createrepo_c-debugsourceUpgrade python3-librepo-debuginfoUpgrade microdnfUpgrade libcompsUpgrade createrepo_c-libsUpgrade libsolv-debugsourceUpgrade python3-libcomps-debuginfoUpgrade libcomps-debugsourceUpgrade microdnf-debuginfoUpgrade libsolv-demo-debuginfoUpgrade dnf-plugins-coreUpgrade python3-dnfUpgrade python3-solv-debuginfoUpgrade libdnf-debuginfoUpgrade libcomps-develUpgrade libcomps-debuginfoUpgrade python3-libdnfUpgrade libcomps-docUpgrade librhsm-debugsourceUpgrade librepo-debuginfoUpgrade yum-utilsUpgrade python3-createrepo_cUpgrade createrepo_c-debuginfoUpgrade python3-librepoUpgrade microdnf-debugsourceUpgrade librepoUpgrade dnf-dataUpgrade python3-dnf-plugins-coreUpgrade libdnfUpgrade libdnf-debugsourceUpgrade librhsmUpgrade libsolv-tools-debuginfoUpgrade librhsm-debuginfoUpgrade perl-solv-debuginfoUpgrade createrepo_cUpgrade librepo-debugsourceUpgrade python3-libdnf-debuginfoUpgrade libsolv-debuginfoUpgrade createrepo_c-develUpgrade ruby-solv-debuginfoUpgrade python3-dnf-plugin-versionlockUpgrade libsolvUpgrade python3-hawkeyUpgrade dnf-automaticUpgrade python3-hawkey-debuginfo | Nov 6, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade libcomps-develUpgrade python3-libcompsUpgrade libcompsUpgrade python2-libcomps | Mar 24, 2020 | Mar 27, 2019 |
| Oracle_linux | — | Upgrade python3-dnfUpgrade dnfUpgrade python3-hawkeyUpgrade libdnfUpgrade microdnfUpgrade python3-createrepo_cUpgrade librepoUpgrade python3-dnf-plugin-versionlockUpgrade python3-libcompsUpgrade python3-libdnfUpgrade dnf-dataUpgrade createrepo_c-develUpgrade libsolvUpgrade dnf-plugins-coreUpgrade createrepo_c-libsUpgrade python3-librepoUpgrade libcompsUpgrade yumUpgrade librhsmUpgrade createrepo_cUpgrade python3-dnf-plugins-coreUpgrade libcomps-develUpgrade dnf-automaticUpgrade yum-utils | Oct 5, 2022 | Jan 21, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade librhsm-debugsourceUpgrade dnf-plugins-coreUpgrade libdnf-debugsourceUpgrade librepo-debuginfoUpgrade libcomps-debuginfoUpgrade python3-createrepo_c-debuginfoUpgrade libdnf-debuginfoUpgrade python3-librepo-debuginfoUpgrade libcompsUpgrade python3-libdnf-debuginfoUpgrade librhsm-debuginfoUpgrade microdnfUpgrade librepo-debugsourceUpgrade python3-dnf-plugin-versionlockUpgrade python3-solv-debuginfoUpgrade python3-libcomps-debuginfoUpgrade perl-solv-debuginfoUpgrade createrepo_c-debugsourceUpgrade python3-libdnfUpgrade libcomps-develUpgrade python3-dnfUpgrade librepoUpgrade libdnfUpgrade librhsmUpgrade ruby-solv-debuginfoUpgrade dnfUpgrade libcomps-debugsourceUpgrade createrepo_c-libs-debuginfoUpgrade microdnf-debuginfoUpgrade dnf-automaticUpgrade dnf-dataUpgrade python3-dnf-plugins-coreUpgrade python3-hawkey-debuginfoUpgrade libsolvUpgrade createrepo_cUpgrade python3-libcompsUpgrade python3-hawkeyUpgrade libsolv-tools-debuginfoUpgrade libsolv-demo-debuginfoUpgrade microdnf-debugsourceUpgrade createrepo_c-libsUpgrade yum-utilsUpgrade libsolv-debugsourceUpgrade createrepo_c-develUpgrade python3-librepoUpgrade createrepo_c-debuginfoUpgrade python3-createrepo_cUpgrade libsolv-debuginfoUpgrade yum | Nov 6, 2019 | Mar 27, 2019 |
| Suse | — | Upgrade libcomps0_1_6Upgrade python3-libcompsUpgrade python2-libcompsUpgrade python-libcomps-docUpgrade libcomps-docUpgrade libcomps-devel | Mar 12, 2019 | Mar 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub