popt, rpm security update

CentOS Errata and Security Advisory CESA-2014:1974

The RPM Package Manager (RPM) is a powerful command line driven package
management system capable of installing, uninstalling, verifying, querying,
and updating software packages. Each software package consists of an
archive of files along with information about the package such as its
version, description, and other information.

It was found that RPM wrote file contents to the target installation
directory under a temporary name, and verified its cryptographic signature
only after the temporary file has been written completely. Under certain
conditions, the system interprets the unverified temporary file contents
and extracts commands from it. This could allow an attacker to modify
signed RPM files in such a way that they would execute code chosen by the
attacker during package installation. (CVE-2013-6435)

This issue was discovered by Florian Weimer of Red Hat Product Security.

All rpm users are advised to upgrade to these updated packages, which
contain a backported patch to correct this issue. All running applications
linked against the RPM library must be restarted for this update to take
effect.

Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2014-December/082980.html
https://lists.centos.org/pipermail/centos-announce/2014-December/082981.html

Affected packages:
popt
rpm
rpm-apidocs
rpm-build
rpm-cron
rpm-devel
rpm-libs
rpm-python

Upstream details at:
https://access.redhat.com/errata/RHSA-2014:1974