A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade librhsm | May 4, 2022 | Mar 27, 2019 |
| Centos_linux | — | Upgrade python3-libdnfUpgrade python3-solv-debuginfoUpgrade python2-libcompsUpgrade createrepo_c-debugsourceUpgrade python3-libcompsUpgrade microdnf-debuginfoUpgrade libcomps-debuginfoUpgrade libcomps-debugsourceUpgrade dnf-plugins-coreUpgrade libsolv-demo-debuginfoUpgrade libcompsUpgrade python3-createrepo_c-debuginfoUpgrade yumUpgrade libsolv-debugsourceUpgrade libcomps-docUpgrade librhsm-debugsourceUpgrade python-libcomps-docUpgrade python3-libcomps-debuginfoUpgrade libdnf-debuginfoUpgrade python3-dnfUpgrade python3-librepo-debuginfoUpgrade createrepo_c-libsUpgrade microdnfUpgrade dnfUpgrade libcomps-develUpgrade createrepo_c-libs-debuginfoUpgrade python3-createrepo_cUpgrade microdnf-debugsourceUpgrade dnf-dataUpgrade createrepo_c-debuginfoUpgrade yum-utilsUpgrade python3-dnf-plugin-versionlockUpgrade libdnfUpgrade python3-dnf-plugins-coreUpgrade librepo-debugsourceUpgrade libsolv-debuginfoUpgrade perl-solv-debuginfoUpgrade librhsmUpgrade createrepo_cUpgrade dnf-automaticUpgrade python3-hawkey-debuginfoUpgrade python3-hawkeyUpgrade librepo-debuginfoUpgrade librepoUpgrade python3-libdnf-debuginfoUpgrade librhsm-debuginfoUpgrade libsolv-tools-debuginfoUpgrade createrepo_c-develUpgrade libsolvUpgrade ruby-solv-debuginfoUpgrade libdnf-debugsourceUpgrade python3-librepo | Nov 6, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-libcompsUpgrade libcomps-develUpgrade libcompsUpgrade python3-libcomps | Mar 24, 2020 | Mar 27, 2019 |
| Oracle_linux | — | Upgrade python3-libcompsUpgrade python3-hawkeyUpgrade python3-createrepo_cUpgrade dnf-dataUpgrade python3-libdnfUpgrade libdnfUpgrade microdnfUpgrade python3-dnf-plugin-versionlockUpgrade librepoUpgrade createrepo_c-develUpgrade dnfUpgrade python3-dnfUpgrade libcomps-develUpgrade yum-utilsUpgrade python3-dnf-plugins-coreUpgrade createrepo_cUpgrade yumUpgrade createrepo_c-libsUpgrade libsolvUpgrade dnf-plugins-coreUpgrade librhsmUpgrade python3-librepoUpgrade libcompsUpgrade dnf-automatic | Oct 5, 2022 | Jan 21, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade dnf-automaticUpgrade libsolv-debugsourceUpgrade yumUpgrade python3-createrepo_cUpgrade python3-hawkeyUpgrade python3-hawkey-debuginfoUpgrade createrepo_cUpgrade libsolv-tools-debuginfoUpgrade python3-librepoUpgrade yum-utilsUpgrade libsolv-demo-debuginfoUpgrade python3-libcompsUpgrade createrepo_c-libsUpgrade microdnf-debugsourceUpgrade python3-dnf-plugins-coreUpgrade dnf-dataUpgrade createrepo_c-debuginfoUpgrade createrepo_c-develUpgrade libsolv-debuginfoUpgrade libsolvUpgrade librepo-debuginfoUpgrade librhsm-debuginfoUpgrade python3-librepo-debuginfoUpgrade python3-libdnf-debuginfoUpgrade libcomps-debuginfoUpgrade librepo-debugsourceUpgrade microdnfUpgrade libdnf-debuginfoUpgrade librhsmUpgrade libcomps-debugsourceUpgrade libdnfUpgrade perl-solv-debuginfoUpgrade python3-dnf-plugin-versionlockUpgrade libcomps-develUpgrade python3-solv-debuginfoUpgrade librepoUpgrade libdnf-debugsourceUpgrade python3-createrepo_c-debuginfoUpgrade libcompsUpgrade python3-libcomps-debuginfoUpgrade librhsm-debugsourceUpgrade dnf-plugins-coreUpgrade python3-libdnfUpgrade python3-dnfUpgrade dnfUpgrade createrepo_c-libs-debuginfoUpgrade microdnf-debuginfoUpgrade createrepo_c-debugsourceUpgrade ruby-solv-debuginfo | Nov 6, 2019 | Mar 27, 2019 |
| Suse | — | Upgrade libcomps0_1_6Upgrade python3-libcompsUpgrade libcomps-develUpgrade python-libcomps-docUpgrade python2-libcompsUpgrade libcomps-doc | Mar 12, 2019 | Mar 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub