High
Security advisory
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-3817
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:35 UTC · Revision 1
Source evidence
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.
osv:CVE-2019-3817
Complete source record
{
"id": "5b23cd816552bb72b05039cf2f42df953dce1af24ac47de1f2121d17ef6a6eab",
"url": "https://osv.dev/vulnerability/CVE-2019-3817",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-3817",
"summary": "A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.",
"evidence": "osv:CVE-2019-3817",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2019-3817",
"aliases": [
"CVE-2019-3817"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/rpm-software-management/libcomps",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "86a82fcd155c27092340d15a34f5c75c4da88243"
},
{
"fixed": "e3a5d056633677959ad924a51758876d415e7046"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:rpm:libcomps:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.1.10"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "e3a5d056633677959ad924a51758876d415e7046"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"libcomps-0.1.9",
"libcomps-0.1.7",
"libcomps-0.1.6",
"libcomps-0.1.5",
"libcomps-0.1.4",
"libcomps-0.1.3",
"libcomps-0.1.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3817.json",
"vanir_signatures": [
{
"id": "CVE-2019-3817-09c12797",
"digest": {
"length": 1720,
"function_hash": "221883842316877266225135665509008155299"
},
"source": "https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046",
"target": {
"file": "libcomps/src/comps_radix.c",
"function": "comps_rtree_unite"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-3817-6262e170",
"digest": {
"threshold": 0.9,
"line_hashes": [
"253665598825233029093033739596960373873",
"337445221573669159305150971171357881214",
"165686396496938068983173430501596014117",
"131845258616473942916386536453394588445",
"86869103249019105588737519873273828133",
"253655779738947529595166061923216200999",
"325780392788154685801315612498824002784",
"80128346591984801325755628513139326636"
]
},
"source": "https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046",
"target": {
"file": "libcomps/src/comps_objmradix.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-3817-65f8301d",
"digest": {
"length": 1967,
"function_hash": "339101478074468591327783017204771854819"
},
"source": "https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046",
"target": {
"file": "libcomps/src/comps_objmradix.c",
"function": "comps_objmrtree_unite"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-3817-68352ec9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"253665598825233029093033739596960373873",
"337445221573669159305150971171357881214",
"165686396496938068983173430501596014117",
"131845258616473942916386536453394588445"
]
},
"source": "https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046",
"target": {
"file": "libcomps/src/comps_radix.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-3817-739582da",
"digest": {
"length": 1699,
"function_hash": "307666424191030074401432142163007664969"
},
"source": "https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046",
"target": {
"file": "libcomps/src/comps_objradix.c",
"function": "comps_objrtree_unite"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-3817-8cc697f9",
"digest": {
"threshold": 0.9,
"line_hashes": [
"253665598825233029093033739596960373873",
"337445221573669159305150971171357881214",
"165686396496938068983173430501596014117",
"131845258616473942916386536453394588445",
"86869103249019105588737519873273828133",
"253655779738947529595166061923216200999",
"325780392788154685801315612498824002784",
"272198591804369979339929438277714930493"
]
},
"source": "https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046",
"target": {
"file": "libcomps/src/comps_mradix.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2019-3817-ce03e02e",
"digest": {
"length": 1956,
"function_hash": "48544156199186513404856293592824836570"
},
"source": "https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046",
"target": {
"file": "libcomps/src/comps_mradix.c",
"function": "comps_mrtree_unite"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2019-3817-d4c713da",
"digest": {
"threshold": 0.9,
"line_hashes": [
"253665598825233029093033739596960373873",
"337445221573669159305150971171357881214",
"165686396496938068983173430501596014117",
"131845258616473942916386536453394588445",
"190462805541812933931988042811062554250",
"338901244845187452905579488875482000055",
"316369999271288864678030682587520042431"
]
},
"source": "https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046",
"target": {
"file": "libcomps/src/comps_objradix.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:55:02Z"
}
}
],
"modified": "2026-10-20T13:55:02.970519934Z",
"provider": "osv",
"references": [
"https://access.redhat.com/errata/RHSA-2019:3583",
"https://access.redhat.com/errata/RHSA-2019:3898",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3817",
"https://github.com/rpm-software-management/libcomps/issues/41",
"https://github.com/rpm-software-management/libcomps/commit/e3a5d056633677959ad924a51758876d415e7046"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-3817",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 388373,
"published_at": "2019-03-27T13:29:01.413+00:00"
}