CVE-2011-3378

Published Dec 24, 2011

Last updated 2 years ago

Overview

Description: RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.
Source: secalert@redhat.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 9.3
Impact score: 10
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:C/I:C/A:C

Weaknesses

nvd@nist.gov: CWE-94

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:rpm:rpm:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "097CBFAF-5967-4C31-80F4-9436413B2020",
            "versionEndIncluding": "4.9.1.1"
          },
          {
            "criteria": "cpe:2.3:a:rpm:rpm:4.4.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "94E5263C-1695-4932-9C20-297067B38F9C"
          },
          {
            "criteria": "cpe:2.3:a:rpm:rpm:4.4.2.:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "308E9B35-F619-4BBE-B1BA-AAF0873F75D2"
          },
          {
            "criteria": "cpe:2.3:a:rpm:rpm:4.4.2.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "77BB52FC-E320-47CD-A180-C22371D7AFEE"
          },
          {
            "criteria": "cpe:2.3:a:rpm:rpm:4.4.2.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "01A746D6-4C15-49BD-B17C-2CA06FFA76D8"
          },
          {
            "criteria": "cpe:2.3:a:rpm:rpm:4.4.2.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E8664CDC-6A09-45F0-B5CD-BE5688FDBB1F"
          },
          {
            "criteria": "cpe:2.3:a:rpm:rpm:4.6.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0FEBBBEE-CE1D-4F4B-B0F7-428814B791BE"
          },
          {
            "criteria": "cpe:2.3:a:rpm:rpm:4.6.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "055D95AA-3797-437E-88FD-764D807B5E2A"
          },
          {
            "criteria": "cpe:2.3:a:rpm:rpm:4.7.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7164A1F5-EE8E-46C6-8E9E-D267CF5936ED"
          },
          {
            "criteria": "cpe:2.3:a:rpm:rpm:4.7.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "62495EC6-B5DB-4AB2-840C-98AC4CE34990"
          },
          {
            "criteria": "cpe:2.3:a:rpm:rpm:4.7.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A87B2FBC-567D-4A1F-AA9C-5DA68C1AA4FD"
          },
          {
            "criteria": "cpe:2.3:a:rpm:rpm:4.8.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6FCD5EE9-2D1F-4042-B53A-C5BA24265709"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References