PT-2019-1351 · Libcomps+4 · Libcomps+4
Published
2019-01-21
·
Updated
2019-11-14
·
CVE-2019-3817
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
libcomps versions prior to 0.1.10
Description
A use-after-free flaw has been discovered in the way ObjMRTrees are merged, related to the
comps objmrtree unite function in the comps objmradix.c file. This issue is associated with the use of memory after it has been freed. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.Recommendations
For versions prior to 0.1.10, update to version 0.1.10 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
comps objmrtree unite function until a patch is available. Avoid using crafted comps XML files that could trigger the use-after-free flaw.Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Red Hat
Suse
Libcomps