{"id":"CVE-2021-44575","aliases":["EUVD-2021-31399","GHSA-fc44-wgfj-x95w","OESA-2022-1569","UBUNTU-CVE-2021-44575"],"status":"rejected","title":"Two heap-overflow vulnerabilities exists in openSUSE libsolv through 13 Dec 2020 in the...","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-787"],"published":"2022-02-21T19:22:21Z","modified":"2026-08-18T01:15:43Z","affected":[{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.14-5.oe1"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.14-6.oe1"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.14-6.oe1"}]}],"bundled":8}],"references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44575","tags":["advisory"]},{"url":"https://github.com/openSUSE/libsolv/issues/427","tags":["report"]},{"url":"https://github.com/yangjiageng/PoC/blob/master/libsolv-PoCs/makeruledecisions-307","tags":["report"]},{"url":"https://github.com/yangjiageng/PoC/blob/master/libsolv-PoCs/makeruledecisions_147","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XVLRHB6CUX3SHYOIGVUQNWAOW5JYANWH/"},{"url":"https://github.com/advisories/GHSA-fc44-wgfj-x95w"},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1569","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44568","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44571","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44573","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44574","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44576","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-44569","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-44575","tags":["report"]},{"url":"https://github.com/openSUSE/libsolv/commit/0077ef29eb46d2e1df2f230fc95a1d9748d49dec","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-44575","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2021-44575","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2022-02-21T19:22:21Z","modified":"2022-06-13T16:17:26Z","updated_at":"2026-11-02T14:33:01.166399Z"}],"euvd":[{"id":"EUVD-2021-31399","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"published","published":"2022-02-21T19:22:21Z","modified":"2022-06-13T16:17:26Z","updated_at":"2026-11-03T03:51:08.805166Z"}],"ghsa":[{"id":"GHSA-fc44-wgfj-x95w","title":"Two heap-overflow vulnerabilities exists in openSUSE libsolv through 13 Dec 2020 in the...","description":"Two heap-overflow vulnerabilities exists in openSUSE libsolv through 13 Dec 2020 in the makeruledecisions function at src/solver.c: line 147 and 307.","status":"published","published":"2022-02-22T00:00:19Z","modified":"2023-02-03T05:06:04Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:53:50.284505Z"}],"nvd":[{"id":"CVE-2021-44575","description":"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage","status":"rejected","published":"2022-02-21T20:15:08.097Z","modified":"2023-11-07T03:39:40.287Z","updated_at":"2026-11-02T14:07:04.6896Z"}],"osv":[{"id":"OESA-2022-1569","title":"libsolv security update","description":"A free package dependency solver using a satisfiability algorithm. The library is based on two major, but independent, blocks:\r\n\r\n\r\n\r\nSecurity Fix(es):\r\n\r\nTwo heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at src/solver.c (line 1940 \u0026amp; line 1995), which could cause a remote Denial of Service.(CVE-2021-44568)\r\n\r\nA heap overflow vulnerability exisfts in openSUSE libsolv through 13 Dec 2020 in the prefer_suggested function at src/policy.c: line 442.(CVE-2021-44571)\r\n\r\nTwo heap-overflow vulnerabilities exist in openSUSE libsolv through 13 Dec 2020 bugs in the propagate function at src/solver.c: line 490 and 524.(CVE-2021-44577)\r\n\r\nTwo heap overflow vulnerabilities exist in oenSUSE libsolv through 13 Dec 2020 in the resolve_installed function at src/solver.c: line 1728 \u0026amp; 1766.(CVE-2021-44573)\r\n\r\nA heap-overflow vulnerability exists in openSUSE libsolv through 13 Dec 2020 in the resolve_jobrules function at src/solver.c at line 1599.(CVE-2021-44574)\r\n\r\nTwo memory vulnerabilities exists in openSUSE libsolv through 13 Dec 2020 in the resolve_weak function at src/solver.c: line 2222 and 2249.(CVE-2021-44576)\r\n\r\nA heap-buffer openSUSE libsolv through 13 Dec 2020 exists in the solver_solve function at src/solver.c: line 3445.(CVE-2021-44569)\r\n\r\nTwo heap-overflow vulnerabilities exists in openSUSE libsolv through 13 Dec 2020 in the makeruledecisions function at src/solver.c: line 147 and 307.(CVE-2021-44575)","status":"published","published":"2022-03-12T11:04:50Z","modified":"2026-08-18T01:15:43.160619526Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-44575","description":"** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-3200 Reason: This candidate is a duplicate of CVE-2021-3200. Notes: All CVE users should reference CVE-2021-3200 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage.","status":"withdrawn","published":"2022-02-21T20:15:00Z","modified":"2025-08-01T04:53:27Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:29.220315Z"}]}}