PT-2019-1351 · Libcomps+4 · Libcomps+4
Publicado
2019-01-21
·
Atualizado
2019-11-14
·
CVE-2019-3817
CVSS v3.1
8.8
Alta
| Vetor | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libcomps versions prior to 0.1.10
Description
A use-after-free flaw has been discovered in the way ObjMRTrees are merged, related to the
comps objmrtree unite function in the comps objmradix.c file. This issue is associated with the use of memory after it has been freed. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.Recommendations
For versions prior to 0.1.10, update to version 0.1.10 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
comps objmrtree unite function until a patch is available. Avoid using crafted comps XML files that could trigger the use-after-free flaw.Exploit
Correção
Use After Free
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Red Hat
Suse
Libcomps