Multiple vulnerabilities have been found in RPM, the worst of which could lead to root privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/rpm | * | < 4.18.0 | >= 4.18.0 |
The Red Hat Package Manager (RPM) is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating computer software packages.
Multiple vulnerabilities have been discovered in RPM. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All RPM users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/rpm-4.18.0"
Multiple vulnerabilities have been found in RPM, the worst of which could result in remote code execution.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/rpm | * | < 4.16.1.3 | >= 4.16.1.3 |
The Red Hat Package Manager (RPM) is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating computer software packages.
Multiple vulnerabilities have been discovered in RPM. Please review the CVE identifiers referenced below for details.
Please review the referenced CVE identifiers for details.
There is no known workaround at this time.
All RPM users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/rpm-4.16.1.3"
Multiple vulnerabilities have been found in RPM, the worst of which could allow a remote attacker to escalate privileges.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/rpm | * | < 4.14.1 | >= 4.14.1 |
The Red Hat Package Manager (RPM) is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating computer software packages.
Multiple vulnerabilities have been discovered in RPM. Please review the CVE identifiers referenced below for details.
A remote attacker, by enticing the user to process a specially crafted RPM file, could escalate privileges, execute arbitrary code, or cause a Denial of Service condition.
There is no known workaround at this time.
All RPM users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/rpm-4.14.1"
Multiple vulnerabilities have been found in RPM, possibly allowing local attackers to gain elevated privileges or remote attackers to execute arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/rpm | * | < 4.9.1.3 | >= 4.9.1.3 |
The Red Hat Package Manager (RPM) is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating computer software packages.
Multiple vulnerabilities have been found in RPM:
A local attacker may be able to gain elevated privileges. Furthermore, a remote attacker could entice a user to open a specially crafted RPM package, possibly resulting in execution of arbitrary code with the privileges of the process or a Denial of Service condition.
There is no known workaround at this time.
All RPM users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/rpm-4.9.1.3"
RPM is vulnerable to a buffer overflow and possibly the execution of arbitrary code when opening specially crafted packages.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| app-arch/rpm | * | < 4.4.6-r3 | >= 4.4.6-r3 |
The Red Hat Package Manager (RPM) is a command line driven package management system capable of installing, uninstalling, verifying, querying, and updating computer software packages.
Vladimir Mosgalin has reported that when processing certain packages, RPM incorrectly allocates memory for the packages, possibly causing a heap-based buffer overflow.
An attacker could entice a user to open a specially crafted RPM package and execute code with the privileges of that user if certain locales are set.
There is no known workaround at this time.
All RPM users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=app-arch/rpm-4.4.6-r3"