21 results · Feed
-
High 7.1
Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, h…
-
High 7.1
Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages
A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one…
-
High 7.8
Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. Th…
-
High 7.8
Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpected…
-
High 7.8
Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()
A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properl…
-
High 7.8
Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path
A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by `rpmbuild -t*` to include shell metacharacters. This is particularly relevant in automated build or continuous int…
-
High 7.0
Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This all…
-
High 7.0
Rpm: rpmbuild gettarspec() crafted tar member name → macro injection
A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro ex…
-
Medium 5.5
Rpm: heap buffer overflow in ndb slot table parsing
A flaw was found in the RPM Package Manager (RPM). A local user could be affected by a heap buffer overflow vulnerability when processing a specially crafted NDB database file. This issue arises from an error in how RPM handles certain calculations during fil…
-
High 7.0
Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level directory name in popen() shell command
A command injection vulnerability was discovered in the `rpmuncompress` utility of RPM. When extracting certain archive formats (ZIP, 7z, GEM) to a specified destination directory, the tool inserts the archive's top-level folder name into a shell command with…
-
Unscored —
It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the pa…
-
Unscored —
A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installin…
-
Unscored —
A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks tha…
-
Unscored —
There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding sign…
-
Unscored —
A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim t…
-
Unscored —
A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause…
-
Unscored —
A flaw was found in RPM's signature check functionality when reading a package file. This flaw allows an attacker who c…
-
High 7.3
It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a direct…
-
Unscored —
It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An…
-
Unscored —
Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose…
-
Unscored —
Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in…