Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 7.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rpm-build-libsUpgrade rpm-libsUpgrade rpm-apidocsUpgrade rpmUpgrade rpm-pythonUpgrade rpm-develUpgrade rpm-signUpgrade rpm-buildUpgrade rpm-cron | Dec 1, 2016 | Dec 16, 2014 |
| Debian | — | Upgrade rpm | Jul 30, 2024 | Dec 16, 2014 |
| Gentoo Linux | — | Upgrade app-arch/rpm. | Nov 29, 2018 | Dec 16, 2014 |
| Oracle_linux | — | Upgrade rpmUpgrade rpm-pythonUpgrade rpm-apidocsUpgrade rpm-develUpgrade rpm-buildUpgrade rpm-build-libsUpgrade rpm-signUpgrade rpm-libsUpgrade rpm-cron | Oct 16, 2024 | Dec 16, 2014 |
| Suse | — | Upgrade rpm-develUpgrade popt-devel-32bitUpgrade rpm-32bitUpgrade rpm-x86Upgrade rpm-buildUpgrade popt-32bitUpgrade rpm-pythonUpgrade popt-x86Upgrade rpmUpgrade popt-develUpgrade rpm-devel-32bitUpgrade popt | Dec 18, 2015 | Dec 16, 2014 |
| Ubuntu | — | Upgrade rpm | Nov 8, 2024 | Dec 16, 2014 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub