{"id":"CVE-2019-3817","aliases":["EUVD-2019-13440","GHSA-3rh7-494q-3mjq","RHSA-2019:3583","RHSA-2019:3898","openSUSE-SU-2019:0323-1","openSUSE-SU-2019:0328-1","openSUSE-SU-2024:10929-1"],"status":"published","title":"A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees...","description":"A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.01721,"percentile":0.77627,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2019-03-15T06:33:59Z","modified":"2026-10-20T13:55:02Z","fixes":[{"ecosystem":"Red Hat:rhel_extras_other:7","package":"libcomps","fixed_in":["0:0.1.8-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"libcomps-debuginfo","fixed_in":["0:0.1.8-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"libcomps-devel","fixed_in":["0:0.1.8-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"libcomps-doc","fixed_in":["0:0.1.8-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"python-libcomps-doc","fixed_in":["0:0.1.8-13.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"python2-libcomps","fixed_in":["0:0.1.8-13.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15","package":"libcomps","fixed_in":["0.1.8-bp150.3.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"createrepo_c-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"createrepo_c-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"createrepo_c-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"createrepo_c-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-createrepo_c","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-createrepo_c-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.11.0-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dnf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.7-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dnf-automatic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.7-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dnf-data","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.7-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"dnf-plugins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.11-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.11-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcomps-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.11-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcomps-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.11-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libdnf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.35.1-8.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libdnf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.35.1-8.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libdnf-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.35.1-8.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.3-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.3-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librepo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.3-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librhsm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librhsm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"librhsm-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.3-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.4-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libsolv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.4-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libsolv-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.4-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libsolv-demo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.4-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libsolv-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.4-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"microdnf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"microdnf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"microdnf-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.0.1-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"perl-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.4-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-dnf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.7-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-dnf-plugin-versionlock","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-dnf-plugins-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-hawkey","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.35.1-8.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-hawkey-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.35.1-8.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.11-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.11-2.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-libdnf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.35.1-8.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-libdnf-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.35.1-8.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-librepo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.3-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-librepo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.10.3-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"python3-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.4-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"ruby-solv-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.4-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"yum","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.7-6.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"yum-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.0.8-3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.8-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"libcomps-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.8-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"libcomps-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.8-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"libcomps-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.8-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"python-libcomps-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.8-13.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"python2-libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.1.8-13.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15","package":"libcomps","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.8-bp150.3.3.1"}]}]}],"products":[{"vendor":"libcomps","product":"libcomps"},{"vendor":"rpm","product":"libcomps"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3817","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Vendor Advisory","report"]},{"url":"https://github.com/rpm-software-management/libcomps/issues/41","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3583","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3898","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-3817","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3rh7-494q-3mjq"},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1650266","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1655605","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1656584","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1656801","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1657703","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1657851","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1658579","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1663533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1665538","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1666325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1667898","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1668005","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1670835","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1671731","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1671839","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1672649","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1673278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1673289","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1673902","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1673913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1673920","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1674562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1676418","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677199","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677583","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1677640","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1678593","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1678596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1678598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1678689","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1679008","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1679509","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1684270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1686645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1686779","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1688537","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1688823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1689331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1689931","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690289","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690299","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1690414","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691315","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1692402","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1694019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1694709","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1695720","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1697946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1699348","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1700250","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1700741","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702678","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1702690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703609","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1706215","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1707453","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1709798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1712055","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1712460","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1713220","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714265","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1714788","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1716313","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717429","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1719830","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1722493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1724668","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1725213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1726141","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1730224","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1737328","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1744979","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1746349","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3583.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20534","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20534","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20534","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-3817","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-3817","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3898.json","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PSQV6NWJAYKECIA3EOSWUDS7AG5DTTRU/#PSQV6NWJAYKECIA3EOSWUDS7AG5DTTRU","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1122841","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3817","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/LOEZMCG6AVPK3VWRT3KLCQFNFHDFCIWU/#LOEZMCG6AVPK3VWRT3KLCQFNFHDFCIWU","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-3817","description":"A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.","status":"published","published":"2019-03-27T12:25:40Z","modified":"2024-08-04T19:19:18.587Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:20:22.701371Z"}],"euvd":[{"id":"EUVD-2019-13440","description":"A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.","status":"published","published":"2019-03-27T12:25:40Z","modified":"2024-08-04T19:19:18Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:06:54.939848Z"}],"ghsa":[{"id":"GHSA-3rh7-494q-3mjq","title":"A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees...","description":"A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.","status":"published","published":"2022-05-24T16:59:27Z","modified":"2024-04-04T02:31:18Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:56:08.751002Z"}],"nvd":[{"id":"CVE-2019-3817","description":"A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.","status":"published","published":"2019-03-27T13:29:01.413Z","modified":"2026-06-17T02:35:39.01Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"CVE-2019-3817","description":"A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.","status":"published","published":"2019-03-27T13:29:01.413Z","modified":"2026-10-20T13:55:02.970519934Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.363788Z"},{"id":"RHSA-2019:3583","title":"Red Hat Security Advisory: yum security, bug fix, and enhancement update","status":"published","published":"2024-09-16T02:19:43Z","modified":"2026-07-20T10:01:17Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2019:3898","title":"Red Hat Security Advisory: libcomps security update","status":"published","published":"2024-09-13T14:11:30Z","modified":"2026-06-26T10:45:11Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"openSUSE-SU-2019:0323-1","title":"Security update for libcomps","description":"This update for libcomps fixes the following issue:\n\t  \nSecurity issue fixed: \n- CVE-2019-3817: Fixed a use-after-free vulnerability in comps_objmradix.c:comps_objmrtree_unite() function\n  where could allow to application crash or code execution (bsc#1122841).\n","status":"published","published":"2019-03-23T11:14:07Z","modified":"2026-02-04T03:36:34.672034Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2019:0328-1","title":"Security update for libcomps","description":"This update for libcomps fixes the following issue:\n\t  \nSecurity issue fixed: \n- CVE-2019-3817: Fixed a use-after-free vulnerability in comps_objmradix.c:comps_objmrtree_unite() function\n  where could allow to application crash or code execution (bsc#1122841).\n\nThis update was imported from the openSUSE:Leap:15.0:Update update project.","status":"published","published":"2019-03-15T06:33:59Z","modified":"2026-02-04T03:08:55.560652Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"openSUSE-SU-2024:10929-1","title":"libcomps-devel-0.1.17-1.2 on GA media","description":"These are all security issues fixed in the libcomps-devel-0.1.17-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:05:35.990407Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}