VYPR
← All advisories
Unrated severityOSV Advisory· Published Dec 28, 2018· Updated Aug 5, 2024

CVE-2018-20534

CVE-2018-20534

Description

There is an illegal address access at ext/testcase.c in libsolv.a in libsolv through 0.7.2 that will cause a denial of service. NOTE: third parties dispute this issue stating that the issue affects the test suite and not the underlying library. It cannot be exploited in any real-world application

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

86

Patches

Vulnerability mechanics

Root cause

"An illegal address access occurs in the pool_whatprovides function within libsolv."

Attack vector

The vulnerability is triggered by an illegal address access in the `pool_whatprovides` function, specifically within `src/pool.h` [ref_id=4]. This issue is noted to affect the test suite rather than the underlying library, and it is stated that it cannot be exploited in real-world applications [ref_id=2]. The specific conditions leading to this access are not detailed beyond the function name and file path.

Affected code

The vulnerability is located in the `pool_whatprovides` function within `src/pool.h` [ref_id=4]. However, the provided patch targets `ext/testcase.c`, specifically altering the logic within the `testcase_read` function [ref_id=2]. This indicates the issue is related to how test cases are processed.

What the fix does

The provided patch modifies `ext/testcase.c` by changing a condition from `!s` to `!s || pieces[1][i - 1] != ')'` [ref_id=2]. This change addresses a potential issue in how test cases are read and parsed. While the CVE description mentions `src/pool.h`, the actual fix is applied to `ext/testcase.c`, suggesting the vulnerability is related to the test suite's input handling rather than a core library function [ref_id=2].

Generated on Jun 3, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

7

News mentions

0

No linked articles in our index yet.