This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Rpm First view 2011-12-24
Product Rpm Last view 2022-08-26
Version 4.9.0 Type Application
Update beta1  
Edition *  
Language *  
Sofware Edition *  
Target Software *  
Target Hardware *  
Other *  
 
CPE Product cpe:2.3:a:rpm:rpm

Activity : Overall

Related : CVE

  Date Alert Description
6.7 2022-08-26 CVE-2021-35939

It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

6.7 2022-08-25 CVE-2021-35938

A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

6.4 2022-08-25 CVE-2021-35937

A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

4.7 2022-08-22 CVE-2021-3521

There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not check the binding signature of subkeys prior to importing them. If an attacker is able to add or socially engineer another party to add a malicious subkey to a legitimate public key, RPM could wrongly trust a malicious signature. The greatest impact of this flaw is to data integrity. To exploit this flaw, an attacker must either compromise an RPM repository or convince an administrator to install an untrusted RPM or public key. It is strongly recommended to only use RPMs and public keys from trusted sources.

5.5 2021-05-19 CVE-2021-3421

A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package or compromise an RPM repository, to cause RPM database corruption. The highest threat from this vulnerability is to data integrity. This flaw affects RPM versions before 4.17.0-alpha.

4.9 2021-04-30 CVE-2021-20266

A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability.

7 2021-03-26 CVE-2021-20271

A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who can convince a victim to install a seemingly verifiable package, whose signature header was modified, to cause RPM database corruption and execute code. The highest threat from this vulnerability is to data integrity, confidentiality, and system availability.

7.8 2018-08-13 CVE-2017-7500

It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.

7.8 2017-11-22 CVE-2017-7501

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.

10 2014-12-16 CVE-2014-8118

Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.

7.6 2014-12-16 CVE-2013-6435

Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory.

6.8 2012-06-04 CVE-2012-0815

The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison.

6.8 2012-06-04 CVE-2012-0061

The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.

6.8 2012-06-04 CVE-2012-0060

RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function.

9.3 2011-12-24 CVE-2011-3378

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

CWE : Common Weakness Enumeration

%idName
26% (4) CWE-59 Improper Link Resolution Before File Access ('Link Following')
13% (2) CWE-347 Improper Verification of Cryptographic Signature
13% (2) CWE-189 Numeric Errors
13% (2) CWE-20 Improper Input Validation
6% (1) CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
6% (1) CWE-345 Insufficient Verification of Data Authenticity
6% (1) CWE-125 Out-of-bounds Read
6% (1) CWE-94 Failure to Control Generation of Code ('Code Injection')
6% (1) CWE-74 Failure to Sanitize Data into a Different Plane ('Injection')

Open Source Vulnerability Database (OSVDB)

id Description
75931 RPM Package Manager lib/header.c regionSwab() Function Region Offset RPM Pack...
75930 RPM Package Manager lib/header.c headerLoad() Function Region Offset RPM Pack...

OpenVAS Exploits

id Description
2012-08-31 Name : VMSA-2012-0013 VMware vSphere and vCOps updates to third party libraries.
File : nvt/gb_VMSA-2012-0013.nasl
2012-08-30 Name : Fedora Update for rpm FEDORA-2012-5298
File : nvt/gb_fedora_2012_5298_rpm_fc17.nasl
2012-08-10 Name : Gentoo Security Advisory GLSA 201206-26 (RPM)
File : nvt/glsa_201206_26.nasl
2012-08-03 Name : Mandriva Update for rpm MDVSA-2012:056 (rpm)
File : nvt/gb_mandriva_MDVSA_2012_056.nasl
2012-07-30 Name : CentOS Update for popt CESA-2011:1349 centos5 x86_64
File : nvt/gb_CESA-2011_1349_popt_centos5_x86_64.nasl
2012-07-30 Name : CentOS Update for popt CESA-2012:0451 centos5
File : nvt/gb_CESA-2012_0451_popt_centos5.nasl
2012-07-30 Name : CentOS Update for rpm CESA-2012:0451 centos6
File : nvt/gb_CESA-2012_0451_rpm_centos6.nasl
2012-07-30 Name : CentOS Update for popt CESA-2011:1349 centos4 x86_64
File : nvt/gb_CESA-2011_1349_popt_centos4_x86_64.nasl
2012-04-23 Name : Fedora Update for rpm FEDORA-2012-5420
File : nvt/gb_fedora_2012_5420_rpm_fc15.nasl
2012-04-23 Name : Fedora Update for rpm FEDORA-2012-5421
File : nvt/gb_fedora_2012_5421_rpm_fc16.nasl
2012-04-05 Name : RedHat Update for rpm RHSA-2012:0451-01
File : nvt/gb_RHSA-2012_0451-01_rpm.nasl
2012-04-02 Name : Fedora Update for rpm FEDORA-2011-13766
File : nvt/gb_fedora_2011_13766_rpm_fc16.nasl
2012-03-15 Name : VMSA-2012-0001 VMware ESXi and ESX updates to third party library and ESX Ser...
File : nvt/gb_VMSA-2012-0001.nasl
2011-11-11 Name : CentOS Update for popt CESA-2011:1349 centos4 i386
File : nvt/gb_CESA-2011_1349_popt_centos4_i386.nasl
2011-10-14 Name : Fedora Update for rpm FEDORA-2011-13785
File : nvt/gb_fedora_2011_13785_rpm_fc15.nasl
2011-10-14 Name : Mandriva Update for rpm MDVA-2011:057 (rpm)
File : nvt/gb_mandriva_MDVA_2011_057.nasl
2011-10-10 Name : RedHat Update for rpm RHSA-2011:1349-01
File : nvt/gb_RHSA-2011_1349-01_rpm.nasl
2011-10-10 Name : CentOS Update for popt CESA-2011:1349 centos5 i386
File : nvt/gb_CESA-2011_1349_popt_centos5_i386.nasl
2011-10-10 Name : Mandriva Update for rpm MDVSA-2011:143 (rpm)
File : nvt/gb_mandriva_MDVSA_2011_143.nasl

Information Assurance Vulnerability Management (IAVM)

id Description
2015-A-0150 Multiple Security Vulnerabilities in Juniper Networks CTPView
Severity: Category I - VMSKEY: V0061073
2012-A-0153 Multiple Vulnerabilities in VMware ESX 4.0 and ESXi 4.0
Severity: Category I - VMSKEY: V0033884
2012-A-0148 Multiple Vulnerabilities in VMware ESXi 4.1 and ESX 4.1
Severity: Category I - VMSKEY: V0033794
2012-A-0020 Multiple Vulnerabilities in VMware ESX 4.1 and ESXi 4.1
Severity: Category I - VMSKEY: V0031252

Nessus® Vulnerability Scanner

This CPE have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2019-01-08 Name: The remote EulerOS host is missing a security update.
File: EulerOS_SA-2019-1011.nasl - Type: ACT_GATHER_INFO
2018-11-29 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201811-22.nasl - Type: ACT_GATHER_INFO
2018-11-06 Name: The remote EulerOS host is missing a security update.
File: EulerOS_SA-2018-1353.nasl - Type: ACT_GATHER_INFO
2018-08-17 Name: The remote PhotonOS host is missing multiple security updates.
File: PhotonOS_PHSA-2017-1_0-0095.nasl - Type: ACT_GATHER_INFO
2017-11-29 Name: The remote Fedora host is missing a security update.
File: fedora_2017-ab57a100f3.nasl - Type: ACT_GATHER_INFO
2017-11-08 Name: The remote Fedora host is missing a security update.
File: fedora_2017-9232eac8e8.nasl - Type: ACT_GATHER_INFO
2016-06-22 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2016-0077.nasl - Type: ACT_GATHER_INFO
2016-03-03 Name: The remote VMware ESXi / ESX host is missing a security-related patch.
File: vmware_VMSA-2012-0001_remote.nasl - Type: ACT_GATHER_INFO
2016-02-29 Name: The remote VMware ESX / ESXi host is missing a security-related patch.
File: vmware_VMSA-2012-0013_remote.nasl - Type: ACT_GATHER_INFO
2016-01-28 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL16383.nasl - Type: ACT_GATHER_INFO
2015-03-26 Name: The remote Debian host is missing a security update.
File: debian_DLA-140.nasl - Type: ACT_GATHER_INFO
2015-03-19 Name: The remote Mandriva Linux host is missing one or more security updates.
File: mandriva_MDVSA-2015-056.nasl - Type: ACT_GATHER_INFO
2015-01-20 Name: The remote Ubuntu host is missing a security-related patch.
File: ubuntu_USN-2479-1.nasl - Type: ACT_GATHER_INFO
2015-01-19 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-3129.nasl - Type: ACT_GATHER_INFO
2014-12-30 Name: The remote Fedora host is missing a security update.
File: fedora_2014-16838.nasl - Type: ACT_GATHER_INFO
2014-12-29 Name: The remote openSUSE host is missing a security update.
File: openSUSE-2014-816.nasl - Type: ACT_GATHER_INFO
2014-12-26 Name: The remote SuSE 11 host is missing one or more security updates.
File: suse_11_popt-141215.nasl - Type: ACT_GATHER_INFO
2014-12-17 Name: The remote Fedora host is missing a security update.
File: fedora_2014-16890.nasl - Type: ACT_GATHER_INFO
2014-12-15 Name: The remote Scientific Linux host is missing one or more security updates.
File: sl_20141209_rpm_on_SL7_x.nasl - Type: ACT_GATHER_INFO
2014-12-15 Name: The remote Scientific Linux host is missing one or more security updates.
File: sl_20141209_rpm_on_SL5_x.nasl - Type: ACT_GATHER_INFO
2014-12-15 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2014-0083.nasl - Type: ACT_GATHER_INFO
2014-12-15 Name: The remote Mandriva Linux host is missing one or more security updates.
File: mandriva_MDVSA-2014-251.nasl - Type: ACT_GATHER_INFO
2014-12-15 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2014-1976.nasl - Type: ACT_GATHER_INFO
2014-12-10 Name: The remote Red Hat host is missing one or more security updates.
File: redhat-RHSA-2014-1976.nasl - Type: ACT_GATHER_INFO
2014-12-10 Name: The remote Red Hat host is missing one or more security updates.
File: redhat-RHSA-2014-1975.nasl - Type: ACT_GATHER_INFO