|
|
| |
|
| |
rpm: multiple vulnerabilities
| Package(s): | rpm |
CVE #(s): | CVE-2010-2197
CVE-2010-2199
|
| Created: | June 25, 2012 |
Updated: | June 27, 2012 |
| Description: |
From the CVE entries:
rpmbuild in RPM 4.8.0 and earlier does not properly parse the syntax of spec files, which allows user-assisted remote attackers to remove home directories via vectors involving a ;~ (semicolon tilde) sequence in a Name tag. (CVE-2010-2197).
lib/fsm.c in RPM 4.8.0 and earlier does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade or deletion of the file in an RPM package removal, which might allow local users to bypass intended access restrictions by creating a hard link to a vulnerable file that has a POSIX ACL, a related issue to CVE-2010-2059. (CVE-2010-2199). |
| Alerts: |
|
( Log in to post comments)
|
|
|