Summary: | <app-arch/rpm-4.9.1.3: Multiple vulnerabilities (CVE-2012-{0060,0061,0815}) | ||
---|---|---|---|
Product: | Gentoo Security | Reporter: | Tim Sammut (RETIRED) <underling> |
Component: | Vulnerabilities | Assignee: | Gentoo Security <security> |
Status: | RESOLVED FIXED | ||
Severity: | normal | CC: | sochotnicky |
Priority: | Normal | ||
Version: | unspecified | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | B2 [glsa] | ||
Package list: | Runtime testing required: | --- |
Description
Tim Sammut (RETIRED)
2012-04-05 20:51:58 UTC
Added 4.9.1.3 which fixes this stuff. @arches: Please stabilise and test app-arch/rpm-4.9.1.3. The only problem is with the maintainer mode which all rpm versions suffer and I have no clue how to fix. If you figure that please feel free to patch it :-) amd64 stable arm stable Stable for HPPA. x86 stable ppc64 done ppc done CVE-2012-0815 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0815): The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison. CVE-2012-0061 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0061): The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header. CVE-2012-0060 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-0060): RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function. alpha/ia64/s390/sh/sparc stable Thanks, everyone. Appending to existing GLSA draft. This issue was resolved and addressed in GLSA 201206-26 at http://security.gentoo.org/glsa/glsa-201206-26.xml by GLSA coordinator Sean Amoss (ackle). |