PT-2014-1868 · Popt+6 · Popt+6

Florian Weimer · Published 2014-12-09 · Updated 2023-02-13 · CVE-2013-6435

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RPM versions 4.11.1 and earlier popt version 1.10.2.3

Description A race condition issue allows remote attackers to execute arbitrary code via a crafted file, potentially leading to a breach of confidentiality, integrity, and availability of protected information. The issue can be exploited remotely.

Recommendations For RPM versions 4.11.1 and earlier, update to a version later than 4.11.1 to resolve the issue. For popt version 1.10.2.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

ALT-PU-2016-2427

ALT-PU-2021-2518

ALT-PU-2021-2600

BDU:2015-07494

CESA-2014_1974

CESA-2014_1976

CVE-2013-6435

DLA-140-1

DSA-3129-1

MGASA-2014-0529

RHSA-2014:1974

RHSA-2014:1975

RHSA-2014:1976

RHSA-2014_1974

RHSA-2014_1976

SUSE-SU-2014_1697-1

SUSE-SU-2015_0107-1

USN-2479-1

Affected Products

Alt Linux

Centos

Rpm

Red Hat

Suse

Ubuntu

Popt

References · 108

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3421 · Security Note
• https://bdu.fstec.ru/vul/2015-05391 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6435 · Security Note
• https://osv.dev/vulnerability/DSA-3129-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04520 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2197 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0060 · Security Note
• https://bdu.fstec.ru/vul/2015-04516 · Security Note
• https://bdu.fstec.ru/vul/2015-06484 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20266 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-6435 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2199 · Security Note
• https://bdu.fstec.ru/vul/2015-04521 · Security Note
• https://bdu.fstec.ru/vul/2015-04515 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0529 · Vendor Advisory