rpm: code execution
| Package(s): | rpm | CVE #(s): | CVE-2012-0060 CVE-2012-0061 CVE-2012-0815 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 4, 2012 | Updated: | May 7, 2012 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | The rpm utility has several parsing flaws that can be exploited via a malicious package file to crash the tool or execute arbitrary code. Importantly, the exploit can happen before the validation of the package file's digital signature, so the checks that would normally stop a hostile package file are ineffective here. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
The LWN site is currently under high scraper load, so comment display has been suppressed for anonymous users. If you are a human, you may read the comments by clicking the button below:
Note: you can avoid this step in the future by logging into your LWN account.