Description
lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rpm | 4.8.1-1 | — |
| Debian 13 | rpm | 4.8.1-1 | — |
| Debian 12 | rpm | 4.8.1-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | popt | 1.10.2.3-20.el5_5.1 | RHSA-2010:0679 |
| RHEL 5 | rpm +5 | 4.4.2.3-20.el5_5.1 | RHSA-2010:0679 |
| RHEL 4 | popt | 1.9.1-33_nonptl.el4_8.1 | RHSA-2010:0678 |
| RHEL 4 | rpm +4 | 4.3.3-33_nonptl.el4_8.1 | RHSA-2010:0678 |
Advisories 2
- RHSA-2010:0679 Red Hat Security Advisory: rpm security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0678 Red Hat Security Advisory: rpm security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://distrib-coffee.ipsl.jussieu.fr/pub/mirrors/rpm/files/rpm/rpm-4.4/rpm-4.4.3.tar.gz
- RHSA-2010:0679 vendor-advisory
- [security-announce] 20110307 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm mailing-list
- http://rpm.org/gitweb?p=rpm.git%3Ba=commit%3Bh=ca2d6b2b484f1501eafdde02e1688409340d2383
- ADV-2011-0606 vdb-entry
- 65143 vdb-entry
- 20110308 VMSA-2011-0004 VMware ESX/ESXi SLPD denial of service vulnerability and ESX third party updates for Service Console packages bind, pam, and rpm. mailing-list
- 40028 third-party-advisory
- [oss-security] 20100603 Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) mailing-list
- MDVSA-2010:180 vendor-advisory
- [oss-security] 20100602 CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) mailing-list
- SUSE-SR:2010:017 vendor-advisory
- SUSE-SR:2010:014 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=598775
- [oss-security] 20100602 Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) mailing-list
- [oss-security] 20100603 Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) mailing-list
- [oss-security] 20100604 Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) mailing-list
- http://www.vmware.com/security/advisories/VMSA-2011-0004.html
- https://bugzilla.redhat.com/show_bug.cgi?id=125517