VYPR
← All advisories
Unrated severityOSV Advisory· Published Dec 28, 2018· Updated Aug 5, 2024

CVE-2018-20533

CVE-2018-20533

Description

There is a NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a in libsolv through 0.7.2 that will cause a denial of service.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

87

Patches

Vulnerability mechanics

Root cause

"A NULL pointer dereference occurs in the testcase_str2dep_complex function when processing dependency strings."

Attack vector

An attacker can trigger this vulnerability by providing a specially crafted dependency string to the libsolv library. This input is processed by the `testcase_str2dep_complex` function, leading to a NULL pointer dereference. The vulnerability is present in libsolv through version 0.7.2 [ref_id=1].

Affected code

The vulnerability resides within the `testcase_str2dep_complex` function, located in the `ext/testcase.c` file within the libsolv library [ref_id=1]. This function is responsible for parsing and handling complex dependency strings.

What the fix does

The advisory indicates that an update for libsolv is available to address this issue [ref_id=1]. While the specific code changes are not detailed in the provided Red Hat advisory, the update is intended to resolve the NULL pointer dereference vulnerability in the `testcase_str2dep_complex` function.

Preconditions

  • inputThe attacker must be able to provide a malformed dependency string as input to the libsolv library.
  • configThe vulnerable version of libsolv (through 0.7.2) must be in use.

Generated on Jun 3, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.