Описание
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
Ссылки
- ExploitIssue TrackingVendor Advisory
- PatchThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
- ExploitIssue TrackingVendor Advisory
- PatchThird Party Advisory
- ExploitIssue TrackingThird Party Advisory
Уязвимые конфигурации
EPSS
7.5 High
CVSS3
8.8 High
CVSS3
6.8 Medium
CVSS2
Дефекты
Связанные уязвимости
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
Уязвимость функции comps_objmrtree_unite библиотеки для работы с XML-файлами libcomps, связанная с использованием памяти после её освобождения, позволяющая нарушителю выполнить произвольный код
ELSA-2019-3583: yum security, bug fix, and enhancement update (MODERATE)
EPSS
7.5 High
CVSS3
8.8 High
CVSS3
6.8 Medium
CVSS2