Skip to content
OpenAdvisories
High ELSA-2014-1976 2 CVEs

Important: rpm security update (Oracle Linux 7)

Published Dec 9, 2014 · Updated Dec 9, 2014

Ecosystem: Oracle Linux

Summary

[4.11.1-18]
- Add check against malicious CPIO file name size (#1163060)
- Fixes CVE-2014-8118

[4.11.1-17]
- Fix race condidition where unchecked data is exposed in the file system
(#1163060)
- Fixes CVE-2013-6435

Fixed packages 9

ReleasePackageFixed in
Oracle Linux · 7 rpm 0:4.11.1-18.el7_0
Oracle Linux · 7 rpm-apidocs 0:4.11.1-18.el7_0
Oracle Linux · 7 rpm-build 0:4.11.1-18.el7_0
Oracle Linux · 7 rpm-build-libs 0:4.11.1-18.el7_0
Oracle Linux · 7 rpm-cron 0:4.11.1-18.el7_0
Oracle Linux · 7 rpm-devel 0:4.11.1-18.el7_0
Oracle Linux · 7 rpm-libs 0:4.11.1-18.el7_0
Oracle Linux · 7 rpm-python 0:4.11.1-18.el7_0
Oracle Linux · 7 rpm-sign 0:4.11.1-18.el7_0

Vulnerabilities 2

  • Unscored —
    CVE-2013-6435

    Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose…

    rpm rpm Debian Ubuntu
  • Unscored —
    CVE-2014-8118

    Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in…

    rpm rpm Debian Ubuntu