USN-4851-1 — libsolv vulnerabilities

Summary

It was discovered that Libsolv incorrectly handled certain malformed input.
An attacker could use this issue to cause Libsolv to crash, resulting in a
denial of service.

Fixed packages 2

Release	Package	Fixed in
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	libsolv	0.6.11-1.1ubuntu0.1~esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS	libsolv	0.6.30-1ubuntu0.1~esm1

Vulnerabilities 3

Unscored —

CVE-2018-20532

There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2…

libsolv libsolv Debian Ubuntu

Dec 28, 2018
Unscored —

CVE-2018-20533

There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv th…

libsolv libsolv Debian Ubuntu

Dec 28, 2018
Unscored —

CVE-2018-20534

There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of …

libsolv libsolv Debian Ubuntu

Dec 28, 2018

References

report
https://ubuntu.com/security/CVE-2018-20532
report
https://ubuntu.com/security/CVE-2018-20533
report
https://ubuntu.com/security/CVE-2018-20534

libsolv vulnerabilities

Summary

Fixed packages 2

Vulnerabilities 3

There is a NULL pointer dereference at ext/testcase.c (function testcase_read) in libsolvext.a in libsolv through 0.7.2…

There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv th…

There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of …

References