CVE-2019-3817
libcomps: use after free when merging two objmrtrees
Loading…
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · January 21, 2019
Updated · February 24, 2026
Description
A use-after-free flaw has been discovered in libcomps in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 7.5CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-416 · Use After Free