[Forgot Password]
Login  Register Subscribe

23631

 
 

126173

 
 

98218

 
 

909

 
 

79224

 
 

109

Paid content will be excluded from the download.


Download | Alert*
CVE
view XML

CVE-2012-0060

Date: (C)2012-06-04   (M)2017-11-18 


RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function.

CVSS Score: 6.8Access Vector: NETWORK
Exploit Score: 8.6Access Complexity: MEDIUM
Impact Score: 6.4Authentication: NONE
 Confidentiality: PARTIAL
 Integrity: PARTIAL
 Availability: PARTIAL





Reference:
SECTRACK-1026882
SECUNIA-48651
SECUNIA-48716
SECUNIA-49110
BID-52865
OSVDB-81010
FEDORA-2012-5298
FEDORA-2012-5420
FEDORA-2012-5421
IAVM:2012-A-0148
IAVM:2012-A-0153
RHSA-2012:0451
RHSA-2012:0531
USN-1695-1
http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=e4eab2bc6d07cfd33f740071de7ddbb2fe2f4190
http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=f23998251992b8ae25faf5113c42fee2c49c7f29
http://rpm.org/wiki/Releases/4.9.1.3
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
https://bugzilla.redhat.com/show_bug.cgi?id=744858
openSUSE-SU-2012:0588
openSUSE-SU-2012:0589
rpm-loadsigverify-code-execution(74582)

CPE    104
cpe:/a:rpm:rpm:4.0.2
cpe:/a:rpm:rpm:4.0.3
cpe:/a:rpm:rpm:4.0.1
cpe:/a:rpm:rpm:2.5.5
...
CWE    1
CWE-20
OVAL    9
oval:org.secpod.oval:def:302832
oval:org.secpod.oval:def:103624
oval:org.secpod.oval:def:202307
oval:org.secpod.oval:def:202308
...

© 2013 SecPod Technologies