CVE-2019-3817 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2019-3817 Interim 1 19 2025-02-17T02:21:10Z current 2021-05-30T14:22:41Z 2025-02-17T02:21:10Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2019-3817 A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PSQV6NWJAYKECIA3EOSWUDS7AG5DTTRU/#PSQV6NWJAYKECIA3EOSWUDS7AG5DTTRU E-Mail link for openSUSE-SU-2019:0323-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LOEZMCG6AVPK3VWRT3KLCQFNFHDFCIWU/#LOEZMCG6AVPK3VWRT3KLCQFNFHDFCIWU E-Mail link for openSUSE-SU-2019:0328-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE Liberty Linux 8 SUSE Package Hub 15 openSUSE Leap 15.0 openSUSE Tumbleweed createrepo_c-0.11.0-3.el8 createrepo_c-devel-0.11.0-3.el8 createrepo_c-libs-0.11.0-3.el8 dnf-4.2.7-6.el8 dnf-automatic-4.2.7-6.el8 dnf-data-4.2.7-6.el8 dnf-plugins-core-4.0.8-3.el8 libcomps-0.1.11-2.el8 libcomps-devel-0.1.11-2.el8 libcomps-devel-0.1.17-1.2 libcomps-devel-0.1.8-bp150.3.3.1 libcomps-devel-0.1.8-lp150.2.3.1 libcomps-doc-0.1.17-1.2 libcomps-doc-0.1.8-bp150.3.3.1 libcomps-doc-0.1.8-lp150.2.3.1 libcomps0-0.1.17-1.2 libcomps0_1_6-0.1.8-bp150.3.3.1 libcomps0_1_6-0.1.8-lp150.2.3.1 libdnf-0.35.1-8.el8 librepo-1.10.3-3.el8 libsolv-0.7.4-3.el8 microdnf-3.0.1-3.el8 python-libcomps-doc-0.1.17-1.2 python-libcomps-doc-0.1.8-bp150.3.3.1 python-libcomps-doc-0.1.8-lp150.2.3.1 python2-libcomps-0.1.8-bp150.3.3.1 python2-libcomps-0.1.8-lp150.2.3.1 python3-createrepo_c-0.11.0-3.el8 python3-dnf-4.2.7-6.el8 python3-dnf-plugin-versionlock-4.0.8-3.el8 python3-dnf-plugins-core-4.0.8-3.el8 python3-hawkey-0.35.1-8.el8 python3-libcomps-0.1.11-2.el8 python3-libcomps-0.1.17-1.2 python3-libcomps-0.1.8-bp150.3.3.1 python3-libcomps-0.1.8-lp150.2.3.1 python3-libdnf-0.35.1-8.el8 python3-librepo-1.10.3-3.el8 yum-4.2.7-6.el8 yum-utils-4.0.8-3.el8 createrepo_c-0.11.0-3.el8 as a component of SUSE Liberty Linux 8 createrepo_c-devel-0.11.0-3.el8 as a component of SUSE Liberty Linux 8 createrepo_c-libs-0.11.0-3.el8 as a component of SUSE Liberty Linux 8 dnf-4.2.7-6.el8 as a component of SUSE Liberty Linux 8 dnf-automatic-4.2.7-6.el8 as a component of SUSE Liberty Linux 8 dnf-data-4.2.7-6.el8 as a component of SUSE Liberty Linux 8 dnf-plugins-core-4.0.8-3.el8 as a component of SUSE Liberty Linux 8 libcomps-0.1.11-2.el8 as a component of SUSE Liberty Linux 8 libcomps-devel-0.1.11-2.el8 as a component of SUSE Liberty Linux 8 libdnf-0.35.1-8.el8 as a component of SUSE Liberty Linux 8 librepo-1.10.3-3.el8 as a component of SUSE Liberty Linux 8 libsolv-0.7.4-3.el8 as a component of SUSE Liberty Linux 8 microdnf-3.0.1-3.el8 as a component of SUSE Liberty Linux 8 python3-createrepo_c-0.11.0-3.el8 as a component of SUSE Liberty Linux 8 python3-dnf-4.2.7-6.el8 as a component of SUSE Liberty Linux 8 python3-dnf-plugin-versionlock-4.0.8-3.el8 as a component of SUSE Liberty Linux 8 python3-dnf-plugins-core-4.0.8-3.el8 as a component of SUSE Liberty Linux 8 python3-hawkey-0.35.1-8.el8 as a component of SUSE Liberty Linux 8 python3-libcomps-0.1.11-2.el8 as a component of SUSE Liberty Linux 8 python3-libdnf-0.35.1-8.el8 as a component of SUSE Liberty Linux 8 python3-librepo-1.10.3-3.el8 as a component of SUSE Liberty Linux 8 yum-4.2.7-6.el8 as a component of SUSE Liberty Linux 8 yum-utils-4.0.8-3.el8 as a component of SUSE Liberty Linux 8 libcomps-devel-0.1.8-bp150.3.3.1 as a component of SUSE Package Hub 15 libcomps-doc-0.1.8-bp150.3.3.1 as a component of SUSE Package Hub 15 libcomps0_1_6-0.1.8-bp150.3.3.1 as a component of SUSE Package Hub 15 python-libcomps-doc-0.1.8-bp150.3.3.1 as a component of SUSE Package Hub 15 python2-libcomps-0.1.8-bp150.3.3.1 as a component of SUSE Package Hub 15 python3-libcomps-0.1.8-bp150.3.3.1 as a component of SUSE Package Hub 15 libcomps-devel-0.1.8-lp150.2.3.1 as a component of openSUSE Leap 15.0 libcomps-doc-0.1.8-lp150.2.3.1 as a component of openSUSE Leap 15.0 libcomps0_1_6-0.1.8-lp150.2.3.1 as a component of openSUSE Leap 15.0 python-libcomps-doc-0.1.8-lp150.2.3.1 as a component of openSUSE Leap 15.0 python2-libcomps-0.1.8-lp150.2.3.1 as a component of openSUSE Leap 15.0 python3-libcomps-0.1.8-lp150.2.3.1 as a component of openSUSE Leap 15.0 libcomps-devel-0.1.17-1.2 as a component of openSUSE Tumbleweed libcomps-doc-0.1.17-1.2 as a component of openSUSE Tumbleweed libcomps0-0.1.17-1.2 as a component of openSUSE Tumbleweed python-libcomps-doc-0.1.17-1.2 as a component of openSUSE Tumbleweed python3-libcomps-0.1.17-1.2 as a component of openSUSE Tumbleweed A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code. CVE-2019-3817 SUSE Liberty Linux 8:createrepo_c-0.11.0-3.el8 SUSE Liberty Linux 8:createrepo_c-devel-0.11.0-3.el8 SUSE Liberty Linux 8:createrepo_c-libs-0.11.0-3.el8 SUSE Liberty Linux 8:dnf-4.2.7-6.el8 SUSE Liberty Linux 8:dnf-automatic-4.2.7-6.el8 SUSE Liberty Linux 8:dnf-data-4.2.7-6.el8 SUSE Liberty Linux 8:dnf-plugins-core-4.0.8-3.el8 SUSE Liberty Linux 8:libcomps-0.1.11-2.el8 SUSE Liberty Linux 8:libcomps-devel-0.1.11-2.el8 SUSE Liberty Linux 8:libdnf-0.35.1-8.el8 SUSE Liberty Linux 8:librepo-1.10.3-3.el8 SUSE Liberty Linux 8:libsolv-0.7.4-3.el8 SUSE Liberty Linux 8:microdnf-3.0.1-3.el8 SUSE Liberty Linux 8:python3-createrepo_c-0.11.0-3.el8 SUSE Liberty Linux 8:python3-dnf-4.2.7-6.el8 SUSE Liberty Linux 8:python3-dnf-plugin-versionlock-4.0.8-3.el8 SUSE Liberty Linux 8:python3-dnf-plugins-core-4.0.8-3.el8 SUSE Liberty Linux 8:python3-hawkey-0.35.1-8.el8 SUSE Liberty Linux 8:python3-libcomps-0.1.11-2.el8 SUSE Liberty Linux 8:python3-libdnf-0.35.1-8.el8 SUSE Liberty Linux 8:python3-librepo-1.10.3-3.el8 SUSE Liberty Linux 8:yum-4.2.7-6.el8 SUSE Liberty Linux 8:yum-utils-4.0.8-3.el8 SUSE Package Hub 15:libcomps-devel-0.1.8-bp150.3.3.1 SUSE Package Hub 15:libcomps-doc-0.1.8-bp150.3.3.1 SUSE Package Hub 15:libcomps0_1_6-0.1.8-bp150.3.3.1 SUSE Package Hub 15:python-libcomps-doc-0.1.8-bp150.3.3.1 SUSE Package Hub 15:python2-libcomps-0.1.8-bp150.3.3.1 SUSE Package Hub 15:python3-libcomps-0.1.8-bp150.3.3.1 openSUSE Leap 15.0:libcomps-devel-0.1.8-lp150.2.3.1 openSUSE Leap 15.0:libcomps-doc-0.1.8-lp150.2.3.1 openSUSE Leap 15.0:libcomps0_1_6-0.1.8-lp150.2.3.1 openSUSE Leap 15.0:python-libcomps-doc-0.1.8-lp150.2.3.1 openSUSE Leap 15.0:python2-libcomps-0.1.8-lp150.2.3.1 openSUSE Leap 15.0:python3-libcomps-0.1.8-lp150.2.3.1 openSUSE Tumbleweed:libcomps-devel-0.1.17-1.2 openSUSE Tumbleweed:libcomps-doc-0.1.17-1.2 openSUSE Tumbleweed:libcomps0-0.1.17-1.2 openSUSE Tumbleweed:python-libcomps-doc-0.1.17-1.2 openSUSE Tumbleweed:python3-libcomps-0.1.17-1.2 important 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H