CLSA-2026-1792689108 rpm: Fix of 3 CVEs

CVE-2026-95519: do not macro expand manifest entries and package paths in rpmgi before opening them - CVE-2026-95521: do not macro expand source package file basenames when installing or rebuilding a source RPM - CVE-2026-78367: do not macro expand the spec file name when parsing a spec, such as...

CLSA-2026-1792688613 rpm: Fix of 3 CVEs

CVE-2026-95519: do not macro expand manifest entries and package paths in rpmgi before opening them - CVE-2026-95521: do not macro expand source package file basenames when installing or rebuilding a source RPM - CVE-2026-78367: do not macro expand the spec file name when parsing a spec, such as...

CVE-2026-95519 Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...

CVE-2026-95519

A flaw in rpm allows for arbitrary code execution when processing a crafted manifest file via commands like rpm -q -p or similar manifest-processing flows. The root cause is that manifest entries undergo unexpected macro expansion before being opened, enabling the execution of embedded shell comm...

CVE-2026-95519 Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using rpm -q -p or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedly macro-expanded before being opened,...