CVE-2012-0061

Publication date 3 April 2012

Last updated 24 July 2024

The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.

Status

Show unmaintained releases

No maintained releases are affected by this CVE.

Package	Ubuntu Release	Status
rpm	12.10 quantal	Not affected
	12.04 LTS precise	Fixed 4.9.1.1-1ubuntu0.1
	11.10 oneiric	Fixed 4.9.0-7ubuntu0.1
	11.04 natty	Ignored end of life
	10.10 maverick	Ignored end of life
	10.04 LTS lucid	Fixed 4.7.2-1lubuntu0.1
	8.04 LTS hardy	Ignored end of life

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
rpm	Upstream: http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=472e569562d4c90d7a298080e0052856aa7fa86b Upstream: http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=858a328cd0f7d4bcd8500c78faaf00e4f8033df6

CVE-2012-0061

Status

Patch details

References

Related Ubuntu Security Notices (USN)

Other references