CVE-2021-44568

Two heap-overflow vulnerabilities exist in openSUSE/libsolv libsolv through 13 Dec 2020 in the decisionmap variable via the resolve_dependencies function at src/solver.c (line 1940 & line 1995), which could cause a remote Denial of Service.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:N/A:P

EPSS

1.79% chance of exploitation in the next 30 days, 77th percentile

Published

2022-02-21

Updated

2024-08-04

Proof-of-concept exploits (2)

• openSUSE/libsolv/issues/425
• yangjiageng/PoC/blob/master/libsolv-PoCs/resolve_dependencies-1940

References

• CVE Record
• NVD entry

Related

• CVE-2021-3200
• CVE-2021-33928
• CVE-2021-33929
• CVE-2021-33930
• CVE-2021-33938
• CVE-2020-23856