CVE-2011-3378

Publication date 24 December 2011

Last updated 24 July 2024

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
rpm	12.10 quantal	Not affected
	12.04 LTS precise	Fixed 4.9.1.1-1ubuntu0.1
	11.10 oneiric	Fixed 4.9.0-7ubuntu0.1
	11.04 natty	Ignored
	10.10 maverick	Ignored
	10.04 LTS lucid	Fixed 4.7.2-1lubuntu0.1
	8.04 LTS hardy	Ignored

Notes

jdstrand

limited attack vector

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
rpm	Upstream: http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=11a7e5d95a8ca8c7d4eaff179094afd8bb74fc3f Upstream: http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=a48f0e20cbe2ababc88b2fc52fb7a281d6fc1656

References

Related Ubuntu Security Notices (USN)