Описание
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2019-3817
- https://github.com/rpm-software-management/libcomps/issues/41
- https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046
- https://access.redhat.com/errata/RHSA-2019:3583
- https://access.redhat.com/errata/RHSA-2019:3898
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3817
Связанные уязвимости
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
Уязвимость функции comps_objmrtree_unite библиотеки для работы с XML-файлами libcomps, связанная с использованием памяти после её освобождения, позволяющая нарушителю выполнить произвольный код
ELSA-2019-3583: yum security, bug fix, and enhancement update (MODERATE)