Description
RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rpm | 4.9.1.2-1 | — |
| Debian 13 | rpm | 4.9.1.2-1 | — |
| Debian 12 | rpm | 4.9.1.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | rpm +6 | 4.8.0-16.el6_1.1 | RHSA-2011:1349 |
| RHEL 5 | popt | 1.10.2.3-22.el5_7.2 | RHSA-2011:1349 |
| RHEL 5 | rpm +5 | 4.4.2.3-22.el5_7.2 | RHSA-2011:1349 |
| RHEL 4 | popt | 1.9.1-35_nonptl.el4 | RHSA-2011:1349 |
| RHEL 4 | rpm +4 | 4.3.3-35_nonptl.el4 | RHSA-2011:1349 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 5 | popt | 1.10.2.3-9.el5_3.2 | RHSA-2011:1349 |
| Red Hat Rhel Mission Critical 5 | rpm +5 | 4.4.2.3-9.el5_3.2 | RHSA-2011:1349 |
| RHEL 6.0 EUS | rpm +6 | 4.8.0-12.el6_0.1 | RHSA-2011:1349 |
| RHEL 3 ELS | popt | 1.8.2-35_nonptl | RHSA-2011:1349 |
| RHEL 3 ELS | rpm +4 | 4.2.3-35_nonptl | RHSA-2011:1349 |
Advisories 1
- RHSA-2011:1349 Red Hat Security Advisory: rpm security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=741612
- https://bugzilla.redhat.com/show_bug.cgi?id=741606
- http://rpm.org/wiki/Releases/4.9.1.2#Security
- MDVSA-2011:143 vendor-advisory
- [oss-security] 20110927 rpm/librpm/rpm-python memory corruption pre-verification mailing-list
- RHSA-2011:1349 vendor-advisory
- SUSE-SU-2011:1140 vendor-advisory
- openSUSE-SU-2011:1203 vendor-advisory
- USN-1695-1 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10691
- http://rpm.org/gitweb?p=rpm.git%3Ba=commitdiff%3Bh=11a7e5d95a8ca8c7d4eaff179094afd8bb74fc3f
- http://rpm.org/gitweb?p=rpm.git%3Ba=commitdiff%3Bh=a48f0e20cbe2ababc88b2fc52fb7a281d6fc1656