PT-2014-8414 · Rpm+5 · Rpm+5

Florian Weimer · Published 2014-12-09 · Updated 2023-02-13 · CVE-2014-8118

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions RPM versions 4.12 and earlier

Description The issue is caused by an integer overflow in RPM, allowing remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file. This triggers a stack-based buffer overflow.

Recommendations For versions 4.12 and earlier, update to a version later than 4.12 to resolve the issue.

Fix

RCE

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2016-2427

ALT-PU-2021-2518

ALT-PU-2021-2600

CESA-2014_1976

CVE-2014-8118

DLA-140-1

DSA-3129-1

MGASA-2014-0529

RHSA-2014:1976

RHSA-2014_1976

USN-2479-1

Affected Products

Alt Linux

Centos

Rpm

Red Hat

Suse

Ubuntu

References · 85

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3421 · Security Note
• https://bdu.fstec.ru/vul/2015-05391 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6435 · Security Note
• https://osv.dev/vulnerability/DSA-3129-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-04520 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2197 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0060 · Security Note
• https://bdu.fstec.ru/vul/2015-04516 · Security Note
• https://bdu.fstec.ru/vul/2015-06484 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20266 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2199 · Security Note
• https://bdu.fstec.ru/vul/2015-04521 · Security Note
• https://bdu.fstec.ru/vul/2015-04515 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0529 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7501 · Security Note