11 results · Feed
-
High 7.1
Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, h…
-
High 7.1
Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages
A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one…
-
High 7.8
Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. Th…
-
High 7.8
Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpected…
-
High 7.8
Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properl…
-
High 7.0
Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This all…
-
Medium 5.5
Rpm: heap buffer overflow in ndb slot table parsing
A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during fil…
-
Unscored —
It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the pa…
-
Unscored —
A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installin…
-
Unscored —
A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks tha…
-
Unscored —
There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding sign…