A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.0 Base Score: 7.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade librhsm | May 4, 2022 | Mar 27, 2019 |
| Centos_linux | — | Upgrade microdnf-debuginfoUpgrade python3-libdnfUpgrade microdnfUpgrade libcomps-debuginfoUpgrade createrepo_c-libs-debuginfoUpgrade python3-solv-debuginfoUpgrade python2-libcompsUpgrade yumUpgrade python3-libcomps-debuginfoUpgrade createrepo_c-debugsourceUpgrade python3-librepo-debuginfoUpgrade libsolv-demo-debuginfoUpgrade dnf-plugins-coreUpgrade python3-dnfUpgrade libcomps-docUpgrade librhsm-debugsourceUpgrade python3-libcompsUpgrade python-libcomps-docUpgrade libcomps-debugsourceUpgrade python3-createrepo_c-debuginfoUpgrade libcompsUpgrade libsolv-debugsourceUpgrade createrepo_c-libsUpgrade libcomps-develUpgrade dnfUpgrade libdnf-debuginfoUpgrade python3-dnf-plugins-coreUpgrade libdnfUpgrade librepoUpgrade python3-librepoUpgrade yum-utilsUpgrade python3-createrepo_cUpgrade dnf-dataUpgrade microdnf-debugsourceUpgrade createrepo_c-debuginfoUpgrade librhsm-debuginfoUpgrade librepo-debuginfoUpgrade python3-hawkey-debuginfoUpgrade createrepo_cUpgrade librhsmUpgrade python3-hawkeyUpgrade python3-libdnf-debuginfoUpgrade ruby-solv-debuginfoUpgrade libsolvUpgrade createrepo_c-develUpgrade libdnf-debugsourceUpgrade libsolv-tools-debuginfoUpgrade perl-solv-debuginfoUpgrade dnf-automaticUpgrade libsolv-debuginfoUpgrade librepo-debugsourceUpgrade python3-dnf-plugin-versionlock | Nov 6, 2019 | Mar 27, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade python2-libcompsUpgrade libcompsUpgrade python3-libcompsUpgrade libcomps-devel | Mar 24, 2020 | Mar 27, 2019 |
| Oracle_linux | — | Upgrade dnf-dataUpgrade python3-createrepo_cUpgrade python3-libdnfUpgrade python3-dnf-plugin-versionlockUpgrade microdnfUpgrade createrepo_c-develUpgrade python3-libcompsUpgrade librepoUpgrade python3-hawkeyUpgrade dnfUpgrade python3-dnfUpgrade libdnfUpgrade createrepo_c-libsUpgrade yumUpgrade libsolvUpgrade dnf-plugins-coreUpgrade yum-utilsUpgrade python3-dnf-plugins-coreUpgrade libcomps-develUpgrade dnf-automaticUpgrade python3-librepoUpgrade libcompsUpgrade createrepo_cUpgrade librhsm | Oct 5, 2022 | Jan 21, 2019 |
| Redhat Openshift | — | Upgrade redhat-coreos | Dec 29, 2020 | Mar 27, 2019 |
| Redhat_linux | — | Upgrade libdnf-debugsourceUpgrade microdnfUpgrade libcomps-debugsourceUpgrade createrepo_c-libs-debuginfoUpgrade python3-librepo-debuginfoUpgrade librepoUpgrade libcompsUpgrade python3-dnf-plugin-versionlockUpgrade libdnf-debuginfoUpgrade librhsm-debuginfoUpgrade librepo-debugsourceUpgrade python3-libdnf-debuginfoUpgrade dnf-plugins-coreUpgrade librhsm-debugsourceUpgrade perl-solv-debuginfoUpgrade libcomps-develUpgrade microdnf-debuginfoUpgrade python3-solv-debuginfoUpgrade python3-libcomps-debuginfoUpgrade python3-libdnfUpgrade python3-createrepo_c-debuginfoUpgrade librepo-debuginfoUpgrade dnfUpgrade libcomps-debuginfoUpgrade libdnfUpgrade ruby-solv-debuginfoUpgrade librhsmUpgrade python3-dnfUpgrade createrepo_c-debugsourceUpgrade dnf-dataUpgrade python3-dnf-plugins-coreUpgrade libsolv-debugsourceUpgrade libsolv-demo-debuginfoUpgrade python3-createrepo_cUpgrade dnf-automaticUpgrade yumUpgrade libsolvUpgrade createrepo_cUpgrade python3-libcompsUpgrade yum-utilsUpgrade python3-hawkeyUpgrade python3-librepoUpgrade createrepo_c-debuginfoUpgrade createrepo_c-develUpgrade python3-hawkey-debuginfoUpgrade createrepo_c-libsUpgrade libsolv-tools-debuginfoUpgrade microdnf-debugsourceUpgrade libsolv-debuginfo | Nov 6, 2019 | Mar 27, 2019 |
| Suse | — | Upgrade libcomps-develUpgrade python2-libcompsUpgrade python-libcomps-docUpgrade libcomps-docUpgrade libcomps0_1_6Upgrade python3-libcomps | Mar 12, 2019 | Mar 11, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub