CVE-2019-3817
27.03.2019, 13:29
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| rpm | libcomps | 𝑥 < 0.1.10 |
𝑥
= Vulnerable software versions
Red Hat Enterprise Linux Releases
Red Hat Product | |||
|---|---|---|---|
| createrepo |
| ||
| dnf |
| ||
| dnf-automatic |
| ||
| dnf-data |
| ||
| dnf-plugins-core |
| ||
| libcomps |
| ||
| libcomps-devel |
| ||
| libdnf |
| ||
| librepo |
| ||
| librhsm |
| ||
| libsolv |
| ||
| microdnf |
| ||
| python3-createrepo |
| ||
| python3-dnf |
| ||
| python3-dnf-plugin-versionlock |
| ||
| python3-dnf-plugins-core |
| ||
| python3-hawkey |
| ||
| python3-libcomps |
| ||
| python3-libdnf |
| ||
| python3-librepo |
| ||
| yum |
| ||
| yum-utils |
|
Common Weakness Enumeration
References