openSUSE libsolv up to 0.7.16 src/repo.h pool_disabled_solvable buffer overflow

Summaryinfo

A vulnerability identified as critical has been detected in openSUSE libsolv up to 0.7.16. This affects the function pool_disabled_solvable of the file src/repo.h. Performing a manipulation results in buffer overflow. This vulnerability was named CVE-2021-33929. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in openSUSE libsolv up to 0.7.16. This affects the function pool_disabled_solvable of the file src/repo.h. The manipulation with an unknown input leads to a buffer overflow vulnerability. CWE is classifying the issue as CWE-120. The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow. This is going to have an impact on availability.

The weakness was presented 09/02/2021. The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2021-33929. Technical details are known, but no exploit is available.

Upgrading to version 0.7.17 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• openSUSE

Name

• libsolv

Version

• 0.7.0
• 0.7.1
• 0.7.2
• 0.7.3
• 0.7.4
• 0.7.5
• 0.7.6
• 0.7.7
• 0.7.8
• 0.7.9
• 0.7.10
• 0.7.11
• 0.7.12
• 0.7.13
• 0.7.14
• 0.7.15
• 0.7.16

License

• open-source

Website

• Product: https://github.com/openSUSE/libsolv/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion