Rpm

CVE-2024-1929 May 08, 02:15 HIGH POC This Week

Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. Rated high severity (CVSS 8.4), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-3445 May 19, 14:15 HIGH This Week

A flaw was found in libdnf's signature verification functionality in versions before 0.60.1. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

CVE-2021-3421 May 19, 14:15 MEDIUM PATCH This Month

A flaw was found in the RPM package in the read functionality. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity.

CVE-2021-20266 Apr 30, 12:15 MEDIUM PATCH This Month

A flaw was found in RPM's hdrblobInit() in lib/header.c. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.

CVE-2021-20271 Mar 26, 17:15 HIGH PATCH This Week

A flaw was found in RPM's signature check functionality when reading a package file. Rated high severity (CVSS 7.0), this vulnerability is no authentication required.

CVE-2019-3817 Mar 27, 13:29 HIGH POC PATCH This Week

A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

CVE-2018-10897 Aug 01, 17:29 HIGH PATCH This Week

A directory traversal issue was found in reposync, a part of yum-utils, where reposync fails to sanitize paths in remote repository configuration files. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.

CVE-2017-7501 Nov 22, 22:29 HIGH PATCH This Week

It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2014-8118 Dec 16, 18:59 CRITICAL Act Now

Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Epss exploitation probability 11.8% and no vendor patch available.

CVE-2013-6435 Dec 16, 18:59 HIGH This Week

Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2012-6088 Jan 18, 11:48 MEDIUM PATCH This Month

The rpmpkgRead function in lib/package.c in RPM 4.10.x before 4.10.2 does not return an error code in certain situations involving an "unparseable signature," which allows remote attackers to bypass. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable.

CVE-2012-0815 Jun 04, 20:55 MEDIUM PATCH This Month

The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable.

CVE-2012-0061 Jun 04, 20:55 MEDIUM This Month

The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.

CVE-2012-0060 Jun 04, 20:55 MEDIUM This Month

RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. No vendor patch available.