OESA-2022-1569

Dashboard / Vulnerabilities / OESA-2022-1569

OESA-2022-1569

Summary: libsolv security update

Details: A free package dependency solver using a satisfiability algorithm. The library is based on two major, but independent, blocks: Security Fix(es): Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at src/solver.c (line 1940 & line 1995), which could cause a remote Denial of Service.(CVE-2021-44568) A heap overflow vulnerability exisfts in openSUSE libsolv through 13 Dec 2020 in the prefer_suggested function at src/policy.c: line 442.(CVE-2021-44571) Two heap-overflow vulnerabilities exist in openSUSE libsolv through 13 Dec 2020 bugs in the propagate function at src/solver.c: line 490 and 524.(CVE-2021-44577) Two heap overflow vulnerabilities exist in oenSUSE libsolv through 13 Dec 2020 in the resolve_installed function at src/solver.c: line 1728 & 1766.(CVE-2021-44573) A heap-overflow vulnerability exists in openSUSE libsolv through 13 Dec 2020 in the resolve_jobrules function at src/solver.c at line 1599.(CVE-2021-44574) Two memory vulnerabilities exists in openSUSE libsolv through 13 Dec 2020 in the resolve_weak function at src/solver.c: line 2222 and 2249.(CVE-2021-44576) A heap-buffer openSUSE libsolv through 13 Dec 2020 exists in the solver_solve function at src/solver.c: line 3445.(CVE-2021-44569) Two heap-overflow vulnerabilities exists in openSUSE libsolv through 13 Dec 2020 in the makeruledecisions function at src/solver.c: line 147 and 307.(CVE-2021-44575)

References: https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1569, https://nvd.nist.gov/vuln/detail/CVE-2021-44568, https://nvd.nist.gov/vuln/detail/CVE-2021-44571, https://nvd.nist.gov/vuln/detail/CVE-2021-44577, https://nvd.nist.gov/vuln/detail/CVE-2021-44573, https://nvd.nist.gov/vuln/detail/CVE-2021-44574, https://nvd.nist.gov/vuln/detail/CVE-2021-44576, https://nvd.nist.gov/vuln/detail/CVE-2021-44569, https://nvd.nist.gov/vuln/detail/CVE-2021-44575