The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade poptUpgrade rpmUpgrade rpm-libsUpgrade rpm-pythonUpgrade rpm-buildUpgrade rpm-apidocsUpgrade rpm-devel | Dec 1, 2016 | Dec 24, 2011 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Dec 24, 2011 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Oct 30, 2017 | Dec 24, 2011 |
| Oracle_linux | — | Upgrade rpmUpgrade rpm-apidocsUpgrade rpm-develUpgrade rpm-pythonUpgrade rpm-buildUpgrade rpm-cronUpgrade poptUpgrade rpm-libs | Oct 16, 2024 | Dec 24, 2011 |
| Suse | — | Upgrade rpm-develUpgrade popt-32bitUpgrade popt-devel-64bitUpgrade poptUpgrade rpm-pythonUpgrade sap-aio-releaseUpgrade popt-64bitUpgrade popt-devel-32bitUpgrade popt-x86Upgrade popt-develUpgrade rpm-32bitUpgrade rpm | Feb 17, 2015 | Dec 24, 2011 |
| Ubuntu | — | Upgrade rpm | Nov 8, 2024 | Dec 24, 2011 |
| Vmsa 2012 0001 | — | Upgrade VMware ESX 4.0 to build number 660575Upgrade VMware ESX 4.1 to build number 582267 | Feb 3, 2012 | Dec 24, 2011 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub