CVE-2021-3200 — Classic Buffer Overflow in Libsolv

CWE-120 — Classic Buffer OverflowCWE-20 — Improper Input ValidationCWE-125 — Out-of-bounds ReadCWE-787 — Out-of-bounds Write16 documents8 sources
Severity
3.3LOWNVD
EPSS
0.0%
top 90.60%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Opensuse LibsolvOracle Communications Cloud Native Core Policy
Timeline
PublishedMay 18
Latest updateMay 24

Description

Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resultp, int *resultflagsp function at src/testcase.c: line 2334, which could cause a denial of service

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:LExploitability: 1.8 | Impact: 1.4

Affected Packages3 packages

▶NVDopensuse/libsolv< 0.7.17
▶Debianopensuse/libsolv< 0.7.17-1+3

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-cphx-qv3m-4vvc: Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resu↗2022-05-24
▶
OSV
CVE-2021-3200: Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resu↗2021-05-18
▶
CVEList
CVE-2021-3200: Buffer overflow vulnerability in libsolv 2020-12-13 via the Solver * testcase_read(Pool *pool, FILE *fp, const char *testcase, Queue *job, char **resu↗2021-05-18
▶

📋Vendor Advisories

12
Oracle
Oracle Oracle Communications Risk Matrix: Signaling (libsolv) — CVE-2021-3200↗2022-04-15
▶
Red Hat
libsolv: Heap overflow↗2022-02-21
▶
Red Hat
libsolv: Heap overflow↗2022-02-21
▶
Red Hat
libsolv: Heap overflow↗2022-02-21
▶
Red Hat
libsolv: Heap overflow↗2022-02-21
▶
CVE-2021-3200 — Classic Buffer Overflow in Libsolv | cvebase