A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade librhsm | May 4, 2022 | Mar 27, 2019 |
| Centos_linux | — | Upgrade python3-libcompsUpgrade python3-dnfUpgrade python3-librepo-debuginfoUpgrade dnfUpgrade python3-libcomps-debuginfoUpgrade libcomps-develUpgrade python2-libcompsUpgrade yumUpgrade libcomps-docUpgrade libcomps-debugsourceUpgrade libcompsUpgrade libcomps-debuginfoUpgrade libsolv-debugsourceUpgrade libsolv-demo-debuginfoUpgrade python3-createrepo_c-debuginfoUpgrade libdnf-debuginfoUpgrade python-libcomps-docUpgrade microdnf-debuginfoUpgrade createrepo_c-libs-debuginfoUpgrade createrepo_c-debugsourceUpgrade python3-solv-debuginfoUpgrade python3-libdnfUpgrade microdnfUpgrade createrepo_c-libsUpgrade librhsm-debugsourceUpgrade dnf-plugins-coreUpgrade perl-solv-debuginfoUpgrade libsolv-tools-debuginfoUpgrade librhsm-debuginfoUpgrade python3-hawkey-debuginfoUpgrade python3-hawkeyUpgrade librepoUpgrade libsolv-debuginfoUpgrade python3-dnf-plugins-coreUpgrade dnf-automaticUpgrade libdnfUpgrade yum-utilsUpgrade ruby-solv-debuginfoUpgrade libsolvUpgrade python3-dnf-plugin-versionlockUpgrade createrepo_c-develUpgrade createrepo_cUpgrade librhsmUpgrade librepo-debugsourceUpgrade python3-createrepo_cUpgrade microdnf-debugsourceUpgrade libdnf-debugsourceUpgrade dnf-dataUpgrade createrepo_c-debuginfoUpgrade python3-librepoUpgrade python3-libdnf-debuginfoUpgrade librepo-debuginfo | Nov 6, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python3-libcompsUpgrade libcompsUpgrade libcomps-develUpgrade python2-libcomps | Mar 24, 2020 | Mar 27, 2019 |
| Oracle_linux | — | Upgrade libcompsUpgrade librhsmUpgrade createrepo_c-libsUpgrade dnf-plugins-coreUpgrade libsolvUpgrade python3-librepoUpgrade yum-utilsUpgrade createrepo_cUpgrade yumUpgrade libcomps-develUpgrade dnf-automaticUpgrade python3-dnf-plugins-coreUpgrade createrepo_c-develUpgrade dnfUpgrade python3-hawkeyUpgrade microdnfUpgrade python3-createrepo_cUpgrade libdnfUpgrade librepoUpgrade dnf-dataUpgrade python3-dnfUpgrade python3-libcompsUpgrade python3-libdnfUpgrade python3-dnf-plugin-versionlock | Oct 5, 2022 | Jan 21, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade libdnfUpgrade dnf-plugins-coreUpgrade dnfUpgrade createrepo_c-debugsourceUpgrade python3-libdnfUpgrade librepo-debuginfoUpgrade librhsmUpgrade python3-dnfUpgrade createrepo_c-libs-debuginfoUpgrade perl-solv-debuginfoUpgrade librepo-debugsourceUpgrade librhsm-debugsourceUpgrade libcomps-debuginfoUpgrade ruby-solv-debuginfoUpgrade python3-libcomps-debuginfoUpgrade microdnf-debuginfoUpgrade python3-libdnf-debuginfoUpgrade python3-dnf-plugin-versionlockUpgrade libcomps-develUpgrade python3-solv-debuginfoUpgrade libcompsUpgrade libdnf-debuginfoUpgrade libdnf-debugsourceUpgrade python3-librepo-debuginfoUpgrade microdnfUpgrade librhsm-debuginfoUpgrade libcomps-debugsourceUpgrade librepoUpgrade python3-createrepo_c-debuginfoUpgrade python3-createrepo_cUpgrade python3-hawkeyUpgrade libsolv-debuginfoUpgrade createrepo_c-libsUpgrade microdnf-debugsourceUpgrade dnf-dataUpgrade python3-dnf-plugins-coreUpgrade libsolvUpgrade libsolv-tools-debuginfoUpgrade python3-libcompsUpgrade libsolv-debugsourceUpgrade dnf-automaticUpgrade libsolv-demo-debuginfoUpgrade python3-librepoUpgrade createrepo_c-debuginfoUpgrade createrepo_c-develUpgrade yum-utilsUpgrade python3-hawkey-debuginfoUpgrade createrepo_cUpgrade yum | Nov 6, 2019 | Mar 27, 2019 |
| Suse | — | Upgrade python-libcomps-docUpgrade python2-libcompsUpgrade libcomps-develUpgrade libcomps-docUpgrade libcomps0_1_6Upgrade python3-libcomps | Mar 12, 2019 | Mar 11, 2019 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub