Heap Overflow Vulnerabilities in openSUSE/libsolv
CVE-2021-44568

6.5MEDIUM

Key Information:

Vendor

Opensuse
Status
Libsolv
Vendor
CVE Published:
21 February 2022

What is CVE-2021-44568?

OpenSUSE/libsolv contains two heap overflow vulnerabilities in the resolve_dependencies function, which can be exploited to disrupt service. These vulnerabilities stem from improper handling of the decisionmap variable in the src/solver.c file, occurring at specific line numbers. Exploitations can lead to remote Denial of Service, impacting the functionality and availability of affected systems.

References

https://github.com/openSUSE/libsolv/issues/425
x_refsource_MISC
https://github.com/yangjiageng/PoC/blob/master/libsolv-Po...
x_refsource_MISC
https://github.com/yangjiageng/PoC/blob/master/libsolv-Po...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.