A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade librhsm | May 4, 2022 | Mar 27, 2019 |
| Centos_linux | — | Upgrade python3-dnf-plugin-versionlockUpgrade librepo-debugsourceUpgrade libsolv-debuginfoUpgrade dnf-automaticUpgrade createrepo_cUpgrade python3-hawkey-debuginfoUpgrade python3-libdnf-debuginfoUpgrade libsolvUpgrade librhsmUpgrade ruby-solv-debuginfoUpgrade createrepo_c-develUpgrade python3-createrepo_cUpgrade yum-utilsUpgrade microdnf-debugsourceUpgrade python3-librepoUpgrade libdnf-debugsourceUpgrade dnf-dataUpgrade libsolv-tools-debuginfoUpgrade createrepo_c-debuginfoUpgrade libdnfUpgrade librepo-debuginfoUpgrade python3-dnf-plugins-coreUpgrade librhsm-debuginfoUpgrade python3-hawkeyUpgrade librepoUpgrade perl-solv-debuginfoUpgrade dnfUpgrade libcomps-develUpgrade libsolv-debugsourceUpgrade dnf-plugins-coreUpgrade yumUpgrade python3-libdnfUpgrade python3-librepo-debuginfoUpgrade python3-dnfUpgrade libcomps-docUpgrade python3-libcomps-debuginfoUpgrade microdnfUpgrade python2-libcompsUpgrade python3-solv-debuginfoUpgrade python3-libcompsUpgrade libdnf-debuginfoUpgrade microdnf-debuginfoUpgrade createrepo_c-libs-debuginfoUpgrade createrepo_c-debugsourceUpgrade python-libcomps-docUpgrade createrepo_c-libsUpgrade libsolv-demo-debuginfoUpgrade libcomps-debugsourceUpgrade librhsm-debugsourceUpgrade python3-createrepo_c-debuginfoUpgrade libcompsUpgrade libcomps-debuginfo | Nov 6, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-libcompsUpgrade libcompsUpgrade libcomps-develUpgrade python3-libcomps | Mar 24, 2020 | Mar 27, 2019 |
| Oracle_linux | — | Upgrade python3-libcompsUpgrade libdnfUpgrade microdnfUpgrade python3-createrepo_cUpgrade python3-dnfUpgrade dnfUpgrade dnf-dataUpgrade python3-dnf-plugin-versionlockUpgrade python3-hawkeyUpgrade librepoUpgrade python3-libdnfUpgrade createrepo_c-develUpgrade libcomps-develUpgrade dnf-automaticUpgrade python3-dnf-plugins-coreUpgrade yumUpgrade createrepo_cUpgrade createrepo_c-libsUpgrade libsolvUpgrade dnf-plugins-coreUpgrade yum-utilsUpgrade librhsmUpgrade python3-librepoUpgrade libcomps | Oct 5, 2022 | Jan 21, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade libsolvUpgrade libsolv-debugsourceUpgrade dnf-dataUpgrade createrepo_c-develUpgrade python3-createrepo_cUpgrade createrepo_c-debuginfoUpgrade python3-dnf-plugins-coreUpgrade python3-hawkey-debuginfoUpgrade libsolv-tools-debuginfoUpgrade python3-hawkeyUpgrade libsolv-debuginfoUpgrade yumUpgrade dnf-automaticUpgrade createrepo_cUpgrade libsolv-demo-debuginfoUpgrade yum-utilsUpgrade createrepo_c-libsUpgrade microdnf-debugsourceUpgrade python3-librepoUpgrade python3-libcompsUpgrade microdnfUpgrade python3-libdnf-debuginfoUpgrade python3-dnfUpgrade libcompsUpgrade python3-librepo-debuginfoUpgrade python3-createrepo_c-debuginfoUpgrade libdnf-debugsourceUpgrade librepoUpgrade libcomps-develUpgrade createrepo_c-libs-debuginfoUpgrade python3-solv-debuginfoUpgrade librhsmUpgrade dnf-plugins-coreUpgrade microdnf-debuginfoUpgrade librhsm-debugsourceUpgrade createrepo_c-debugsourceUpgrade libcomps-debuginfoUpgrade python3-libdnfUpgrade dnfUpgrade librepo-debuginfoUpgrade ruby-solv-debuginfoUpgrade perl-solv-debuginfoUpgrade python3-dnf-plugin-versionlockUpgrade libdnfUpgrade librepo-debugsourceUpgrade libcomps-debugsourceUpgrade libdnf-debuginfoUpgrade librhsm-debuginfoUpgrade python3-libcomps-debuginfo | Nov 6, 2019 | Mar 27, 2019 |
| Suse | — | Upgrade python2-libcompsUpgrade libcomps-docUpgrade python-libcomps-docUpgrade libcomps-develUpgrade libcomps0_1_6Upgrade python3-libcomps | Mar 12, 2019 | Mar 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub