RP
Product
Rpm
21
CVEs
0
On KEV
7.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 3Medium 6Low 0
Watch
Add Rpm to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-7500 | 7.8 | Aug 13 | It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an… Affected: 4.13.0.0 before 4.13.0.2; 4.14.0.0; 4.14.0.0 |
| CVE-2017-7501 | 7.8 | Nov 22 | It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM Affected: before 4.13.0.3 |
| CVE-2021-20271 | 7.0 | Mar 26 | A flaw was found in RPM's signature check functionality when reading a package file Affected: 4.15.0 before 4.15.1.3; 4.16.0 before 4.16.1.3; 4.15.0; 4.15.0; 4.15.0; 4.16.0; +3 more |
| CVE-2021-35939 | 6.7 | Aug 26 | It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created Affected: before 4.18 |
| CVE-2021-35938 | 6.7 | Aug 25 | A symbolic link issue was found in rpm Affected: before 4.18.0 |
| CVE-2021-35937 | 6.4 | Aug 25 | A race condition vulnerability was found in rpm Affected: before 4.18.0 |
| CVE-2021-3421 | 5.5 | May 19 | A flaw was found in the RPM package in the read functionality Affected: before 4.16.1.3 |
| CVE-2021-20266 | 4.9 | Apr 30 | A flaw was found in RPM's hdrblobInit() in lib/header.c Affected: before 4.16.1.3 |
| CVE-2021-3521 | 4.7 | Aug 22 | There is a flaw in RPM's signature functionality Affected: before 4.17.1 |
| CVE-2014-8118 | – | Dec 16 | Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a… Affected: through 4.12.0; 1.2; 1.3; 1.3.1; 1.4; 1.4.1; +34 more |
| CVE-2013-6435 | – | Dec 16 | Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files… Affected: through 4.11.1; 1.2; 1.3; 1.3.1; 1.4; 1.4.1; +34 more |
| CVE-2012-6088 | – | Jan 18 | The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote… Affected: 4.10.0; 4.10.1 |
| CVE-2012-0815 | – | Jun 4 | The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative… Affected: through 4.9.1.2; 1.2; 1.3; 1.3.1; 1.4; 1.4.1; +34 more |
| CVE-2012-0061 | – | Jun 4 | The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service… Affected: through 4.9.1.2; 1.2; 1.3; 1.3.1; 1.4; 1.4.1; +34 more |
| CVE-2012-0060 | – | Jun 4 | RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid… Affected: through 4.9.1.2; 1.2; 1.3; 1.3.1; 1.4; 1.4.1; +34 more |
| CVE-2011-3378 | – | Dec 24 | RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package… Affected: through 4.9.1.1; 4.4.2; 4.4.2.; 4.4.2.1; 4.4.2.2; 4.4.2.3; +6 more |
| CVE-2010-2199 | – | Jun 8 | lib/fsm.c in RPM 4.8.0 and earlier does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade or deletion of the file in… Affected: 1.2; 1.3; 1.3.1; 1.4; 1.4.2; 1.4.2/a; +34 more |
| CVE-2010-2198 | – | Jun 8 | lib/fsm.c in RPM 4.8.0 and earlier does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade or deletion of the file in… Affected: 1.2; 1.3; 1.3.1; 1.4; 1.4.2; 1.4.2/a; +34 more |
| CVE-2010-2197 | – | Jun 8 | rpmbuild in RPM 4.8.0 and earlier does not properly parse the syntax of spec files, which allows user-assisted remote attackers to remove home directories via vectors involving a… Affected: 1.2; 1.3; 1.3.1; 1.4; 1.4.2; 1.4.2/a; +34 more |
| CVE-2010-2059 | – | Jun 8 | lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in… Affected: through 4.4.2.3; 1.2; 1.3; 1.3.1; 1.4; 1.4.2; +34 more |
| CVE-2005-4889 | – | Jun 8 | lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to… Affected: through 4.4.2.3; 1.2; 1.3; 1.3.1; 1.4; 1.4.2; +34 more |
Showing 21