CVE-2012-0060

Publication date 3 April 2012

Last updated 24 July 2024

RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function.

Status

Show unmaintained releases

Package	Ubuntu Release	Status
rpm	12.10 quantal	Not affected
	12.04 LTS precise	Fixed 4.9.1.1-1ubuntu0.1
	11.10 oneiric	Fixed 4.9.0-7ubuntu0.1
	11.04 natty	Ignored end of life
	10.10 maverick	Ignored end of life
	10.04 LTS lucid	Fixed 4.7.2-1lubuntu0.1
	8.04 LTS hardy	Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
rpm	Upstream: http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=e4eab2bc6d07cfd33f740071de7ddbb2fe2f4190 Upstream: http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=f23998251992b8ae25faf5113c42fee2c49c7f29

CVE-2012-0060

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references