Important: rpm

Issue Overview: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote attacker to execute arbitrary code on the system by convincing a user to build a malicious...

openSUSE 16: librpmbuild10 / python313-rpm / rpm / rpm-build / rpm-devel / etc (openSUSE-SU-2026:21856-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21856-1 advisory. Changes in rpm: - split imaevmsign plugin into a multibuild flavor Changes in rpm: - Add Requires: rpm-plugin-selinux if selinux-policy - harden...

SUSE-SU-2026:23796-1 Security update for rpm

This update for rpm fixes the following issues: Changes in rpm: - split imaevmsign plugin into a multibuild flavor Changes in rpm: - Add Requires: rpm-plugin-selinux if selinux-policy - harden ndb code bsc1269584 CVE-2026-44605 - split all plugins into subpackages this allows for an easy way to g...

OPENSUSE-SU-2026:21856-1 Security update for rpm

This update for rpm fixes the following issues: Changes in rpm: - split imaevmsign plugin into a multibuild flavor Changes in rpm: - Add Requires: rpm-plugin-selinux if selinux-policy - harden ndb code bsc1269584 CVE-2026-44605 - split all plugins into subpackages this allows for an easy way to g...

rpm: Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

SUSE CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

Linux Distros Unpatched Vulnerability : CVE-2026-84838

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress...

AZL-99372 CVE-2026-84838 affecting package rpm 4.18.2-2

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

UBUNTU-CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84838 Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84838

CVE-2026-84838 is a command injection vulnerability in rpmuncompress , a component of the RPM package management toolset. The root cause is that archive filenames containing shell metacharacters are not properly escaped before being passed to shell command strings via popen() , allowing a local a...

CVE-2026-84838 Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

EUVD-2026-70109

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

CVE-2026-84838

A flaw was found in rpmuncompress. This command injection vulnerability allows a local attacker to execute arbitrary commands. This occurs when rpmuncompress processes a specially crafted archive filename containing shell metacharacters, which are not properly escaped before being passed to shell...

SUSE CVE-2026-84233

A flaw was found in rpm. A local attacker could supply a specially crafted .gem filename containing RPM macro syntax. When a user or automated workflow invokes rpmuncompress -x on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary...

PT-2026-84802

Name of the Vulnerable Software and Affected Versions rpmuncompress affected versions not specified Description A command injection flaw exists in rpmuncompress that allows a local attacker to execute arbitrary commands. The issue occurs when the tool processes a specially crafted archive filenam...