User: Password:
Subscribe / Log in / New account

rpm: arbitrary code execution

Package(s):rpm CVE #(s):CVE-2011-3378
Created:October 4, 2011 Updated:November 10, 2011
Description: From the Red Hat advisory:

Multiple flaws were found in the way the RPM library parsed package headers. An attacker could create a specially-crafted RPM package that, when queried or installed, would cause rpm to crash or, potentially, execute arbitrary code. (CVE-2011-3378)

Note: Although an RPM package can, by design, execute arbitrary code when installed, this issue would allow a specially-crafted RPM package to execute arbitrary code before its digital signature has been verified. Package downloads from the Red Hat Network remain secure due to certificate checks performed on the secure connection.

Ubuntu USN-1695-1 rpm 2013-01-17
Gentoo 201206-26 rpm 2012-06-24
CentOS CESA-2011:1349 rpm 2011-11-09
SUSE SUSE-SU-2011:1140-2 popt 2011-11-03
openSUSE openSUSE-SU-2011:1203-1 rpm 2011-11-03
SUSE SUSE-SU-2011:1140-1 popt 2011-10-17
Fedora FEDORA-2011-13785 rpm 2011-10-05
Mandriva MDVSA-2011:143 rpm 2011-10-05
Scientific Linux SL-rpm-20111003 rpm 2011-10-03
CentOS CESA-2011:1349 rpm 2011-10-03
Red Hat RHSA-2011:1349-01 rpm 2011-10-03

(Log in to post comments)

Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds