Red Hat Security AdvisoryRHSA-2014:1976
rpm security update
Released 2014-12-09 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) rpm-4.11.1-18.el7_0, rpm-build-4.11.1-18.el7_0, rpm-build-libs-4.11.1-18.el7_0 +2
- Red Hat Enterprise Linux Client Optional (v. 7) rpm-apidocs-4.11.1-18.el7_0, rpm-cron-4.11.1-18.el7_0, rpm-devel-4.11.1-18.el7_0 +1
- Red Hat Enterprise Linux ComputeNode (v. 7) rpm-4.11.1-18.el7_0, rpm-build-4.11.1-18.el7_0, rpm-build-libs-4.11.1-18.el7_0 +2
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) rpm-apidocs-4.11.1-18.el7_0, rpm-cron-4.11.1-18.el7_0, rpm-devel-4.11.1-18.el7_0 +1
- Red Hat Enterprise Linux Server (v. 7) rpm-4.11.1-18.el7_0, rpm-build-4.11.1-18.el7_0, rpm-build-libs-4.11.1-18.el7_0 +7
- Red Hat Enterprise Linux Server Optional (v. 7) rpm-apidocs-4.11.1-18.el7_0, rpm-cron-4.11.1-18.el7_0
- Red Hat Enterprise Linux Workstation (v. 7) rpm-4.11.1-18.el7_0, rpm-build-4.11.1-18.el7_0, rpm-build-libs-4.11.1-18.el7_0 +4
- Red Hat Enterprise Linux Workstation Optional (v. 7) rpm-apidocs-4.11.1-18.el7_0, rpm-cron-4.11.1-18.el7_0
Fixes 2 records
Priority MEDIUM 53
Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.
CVSS 2.0HIGH 10.0· Network · No auth · Interaction — · EPSS 0.0755 · Published 2014-12-16 · Fixed CWE-189
Priority MEDIUM 44
Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrat…
CVSS 2.0HIGH 7.6· Network · No auth · Interaction — · EPSS 0.07606 · Published 2014-12-16 · Fixed CWE-74
