CVE-2011-3378

2011-12-2419:55:00

CWE-94

[email protected]

web.nvd.nist.gov

cve

rpm

denial of service

memory corruption

arbitrary code

remote attackers

nvd

8.2 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.058 Low

EPSS

Percentile

93.3%

JSON

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

CPENameOperatorVersion
rpm:rpmrpmeq4.4.2.1
rpm:rpmrpmeq4.8.0
rpm:rpmrpmeq4.4.2
rpm:rpmrpmeq4.6.0
rpm:rpmrpmeq4.4.2.2
rpm:rpmrpmeq4.7.2
rpm:rpmrpmeq4.7.0
rpm:rpmrpmeq4.4.2.3
rpm:rpmrpmeq4.6.1
rpm:rpmrpmeq4.7.1

CPE	Name	Operator	Version
rpm:rpm	rpm	eq	4.4.2.1
rpm:rpm	rpm	eq	4.8.0
rpm:rpm	rpm	eq	4.4.2
rpm:rpm	rpm	eq	4.6.0
rpm:rpm	rpm	eq	4.4.2.2
rpm:rpm	rpm	eq	4.7.2
rpm:rpm	rpm	eq	4.7.0
rpm:rpm	rpm	eq	4.4.2.3
rpm:rpm	rpm	eq	4.6.1
rpm:rpm	rpm	eq	4.7.1