UBUNTU-CVE-2019-20387: High severity ubuntu/libsolv vulnerability
Published Jan 21, 2020
·Updated
repodataschema2id in repodata.c in libsolv before 0.7.6 has a heap-based buffer over-read via a last schema whose length is less than the length of the input schema.
Affected Software
1 affected componentFixes available
ubuntu/libsolv<0.6.30-1ubuntu0.1~esm2
0.6.30-1ubuntu0.1~esm2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/libsolvto a version that resolves this vulnerability.Fixed in 0.6.30-1ubuntu0.1~esm2
Event History
Jan 21, 2020
CVE Published
via OSV·11:15 PM
Data Sourced
via OSV·11:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
Which libsolv versions are affected?
The issue affects libsolv versions before 0.7.6. Updating to version 0.7.6 or later addresses the vulnerable code path.
2
Can this be exploited remotely without authentication or user interaction?
The supplied severity vector indicates network access, low attack complexity, no privileges required, and no user interaction. The reported impact is denial of service through a heap-based buffer over-read.