Skip to content
OpenAdvisories
Unscored USN-2479-1 2 CVEs

rpm vulnerabilities

Published Jan 19, 2015 · Updated Apr 22, 2026

Ecosystem: Ubuntu

Summary

Florian Weimer discovered that RPM incorrectly handled temporary files. A
local attacker could use this issue to execute arbitrary code.
(CVE-2013-6435)

Florian Weimer discovered that RPM incorrectly handled certain CPIO
headers. If a user or automated system were tricked into installing a
malicious package file, a remote attacker could use this issue to cause RPM
to crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2014-8118)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS rpm 4.11.1-3ubuntu0.1

Vulnerabilities 2

  • Unscored —
    CVE-2013-6435

    Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose…

    rpm rpm Debian Ubuntu
  • Unscored —
    CVE-2014-8118

    Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in…

    rpm rpm Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2013-6435
  • report
    https://ubuntu.com/security/CVE-2014-8118