Rpm
Monthly
Heap-based buffer overflow in RPM's package-header parsing lets a crafted, unsigned RPM overwrite memory when a victim merely inspects it with rpm2cpio, rpm2archive, or 'rpm -qlvp', giving an attacker-controlled heap write past a one-byte allocation (CWE-122, assessed CVSS 3.1 7.1). Affected code ships with RPM as distributed in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat Hardened Images, so build farms, CI pipelines, package mirrors, and malware-analysis hosts that routinely open untrusted packages are the realistic exposure surface. Exploitation is local (AV:L), low complexity (AC:L), and unauthenticated (PR:N) but requires user interaction (UI:R) to invoke an rpm tool against the malicious file; signature verification is no barrier because the overflow happens during header decoding. No public exploit identified at time of analysis.
Heap-based out-of-bounds write in the RPM Package Manager (rpm) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, allowing a local, unauthenticated attacker to corrupt memory by crafting an RPM package that is then parsed with rpm2cpio, rpm2archive, or rpm -qlvp. The flaw arises from an integer overflow in iterReadArchiveNext() when a symlink entry declares RPMTAG_LONGFILESIZES as 0xFFFFFFFFFFFFFFFF, shrinking the buffer allocation to one byte and enabling attacker-controlled data from the cpio filesize field to overwrite heap memory. Exploitation requires user interaction to inspect the malicious package and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 7.1.
Command injection in rpm enables an attacker to run arbitrary shell commands as the invoking user when a victim installs, rebuilds, or otherwise processes a malicious source RPM (.src.rpm) that contains a %() macro construct in a source or spec file basename. The flaw is local and requires user interaction, with impact confined to the privileges of the user running rpm or rpmbuild, typically non-root; build farms and CI/CD pipelines that automatically handle untrusted SRPMs are the highest-risk targets. Red Hat CPEs list RHEL 6 through 10 and Red Hat Hardened Images, and no public exploit was identified in the provided intelligence; monitor the vendor advisory for exploitation and patch updates.
Local attackers can achieve arbitrary code execution by tricking a user or automation into processing a crafted manifest file with 'rpm -q -p', due to unexpected macro expansion of manifest entries in RPM before they are opened. This command injection flaw (CWE-78) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with a CVSS 3.1 base score of 7.8 (HIGH, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation requires user interaction but no privileges, and impact is limited to the privileges of the rpm process. No public exploit code or active exploitation has been identified at time of analysis.
Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in the RPM package in the read functionality. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
A flaw was found in RPM's hdrblobInit() in lib/header.c. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
A flaw was found in RPM's signature check functionality when reading a package file. Rated high severity (CVSS 7.0), this vulnerability is no authentication required.
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 11.8% and no vendor patch available.
Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable. No vendor patch available.
The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
Heap-based buffer overflow in RPM's package-header parsing lets a crafted, unsigned RPM overwrite memory when a victim merely inspects it with rpm2cpio, rpm2archive, or 'rpm -qlvp', giving an attacker-controlled heap write past a one-byte allocation (CWE-122, assessed CVSS 3.1 7.1). Affected code ships with RPM as distributed in Red Hat Enterprise Linux 6, 7, 8, 9, and 10 as well as Red Hat Hardened Images, so build farms, CI pipelines, package mirrors, and malware-analysis hosts that routinely open untrusted packages are the realistic exposure surface. Exploitation is local (AV:L), low complexity (AC:L), and unauthenticated (PR:N) but requires user interaction (UI:R) to invoke an rpm tool against the malicious file; signature verification is no barrier because the overflow happens during header decoding. No public exploit identified at time of analysis.
Heap-based out-of-bounds write in the RPM Package Manager (rpm) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, allowing a local, unauthenticated attacker to corrupt memory by crafting an RPM package that is then parsed with rpm2cpio, rpm2archive, or rpm -qlvp. The flaw arises from an integer overflow in iterReadArchiveNext() when a symlink entry declares RPMTAG_LONGFILESIZES as 0xFFFFFFFFFFFFFFFF, shrinking the buffer allocation to one byte and enabling attacker-controlled data from the cpio filesize field to overwrite heap memory. Exploitation requires user interaction to inspect the malicious package and no public exploit code has been identified at time of analysis; the CVSS 3.1 base score is 7.1.
Command injection in rpm enables an attacker to run arbitrary shell commands as the invoking user when a victim installs, rebuilds, or otherwise processes a malicious source RPM (.src.rpm) that contains a %() macro construct in a source or spec file basename. The flaw is local and requires user interaction, with impact confined to the privileges of the user running rpm or rpmbuild, typically non-root; build farms and CI/CD pipelines that automatically handle untrusted SRPMs are the highest-risk targets. Red Hat CPEs list RHEL 6 through 10 and Red Hat Hardened Images, and no public exploit was identified in the provided intelligence; monitor the vendor advisory for exploitation and patch updates.
Local attackers can achieve arbitrary code execution by tricking a user or automation into processing a crafted manifest file with 'rpm -q -p', due to unexpected macro expansion of manifest entries in RPM before they are opened. This command injection flaw (CWE-78) affects Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with a CVSS 3.1 base score of 7.8 (HIGH, AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); exploitation requires user interaction but no privileges, and impact is limited to the privileges of the rpm process. No public exploit code or active exploitation has been identified at time of analysis.
Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in the RPM package in the read functionality. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.
A flaw was found in RPM's hdrblobInit() in lib/header.c. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
A flaw was found in RPM's signature check functionality when reading a package file. Rated high severity (CVSS 7.0), this vulnerability is no authentication required.
A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.
It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 11.8% and no vendor patch available.
Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable. No vendor patch available.
The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.
The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.
The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.
RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.