Vulnerability Details : CVE-2012-0061
The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.
Vulnerability category: Input validationExecute codeDenial of service
Exploit prediction scoring system (EPSS) score for CVE-2012-0061
Probability of exploitation activity in the next 30 days: 4.45%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 91 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-0061
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST |
CWE ids for CVE-2012-0061
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: nvd@nist.gov (Primary)
References for CVE-2012-0061
-
http://rpm.org/wiki/Releases/4.9.1.3
rpm.org - Releases
-
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078907.html
[SECURITY] Fedora 16 Update: rpm-4.9.1.3-1.fc16
-
http://rhn.redhat.com/errata/RHSA-2012-0531.html
RHSA-2012:0531 - Security Advisory - Red Hat Customer Portal
-
https://bugzilla.redhat.com/show_bug.cgi?id=798585
798585 – (CVE-2012-0061) CVE-2012-0061 rpm: improper validation of header contents total size in headerLoad()
-
https://exchange.xforce.ibmcloud.com/vulnerabilities/74583
RPM Package Manager headerLoad() code execution CVE-2012-0061 Vulnerability Report
-
https://hermes.opensuse.org/messages/14441362
openSUSE.org - 503
-
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077960.html
[SECURITY] Fedora 17 Update: rpm-4.9.1.3-1.fc17
-
http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078819.html
[SECURITY] Fedora 15 Update: rpm-4.9.1.3-1.fc15
-
http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=472e569562d4c90d7a298080e0052856aa7fa86b
Page not found · GitHub PagesPatch
-
http://www.securityfocus.com/bid/52865
RPM Multiple Denial of Service Vulnerabilities
-
http://www.ubuntu.com/usn/USN-1695-1
USN-1695-1: RPM vulnerabilities | Ubuntu security notices
-
http://rhn.redhat.com/errata/RHSA-2012-0451.html
RHSA-2012:0451 - Security Advisory - Red Hat Customer Portal
-
http://rpm.org/gitweb?p=rpm.git;a=commitdiff;h=858a328cd0f7d4bcd8500c78faaf00e4f8033df6
Page not found · GitHub PagesPatch
-
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
Oracle VM Server for x86 Bulletin - July 2016
-
https://hermes.opensuse.org/messages/14440932
openSUSE.org - 503
-
http://www.mandriva.com/security/advisories?name=MDVSA-2012:056
mandriva.com
-
http://www.securitytracker.com/id?1026882
RPM Package Manager Header Processing and Signature Validation Bugs Let Remote Users Execute Arbitrary Code - SecurityTracker
Products affected by CVE-2012-0061
- cpe:2.3:a:rpm:rpm:*:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.9:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.11:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.4.2\/a:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.5:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.6:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.5:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:3.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.4:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.0.:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.4.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.4.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.5.5:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.5.6:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:3.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:3.0:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.8:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2.10:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:3.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:3.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:2.5.4:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:3.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:3.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.4.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.9.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.9.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.9.0:alpha:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.6.0:rc4:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.9.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.6.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.6.0:rc2:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:1.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.5.90:*:*:*:*:*:*:*
- cpe:2.3:a:rpm:rpm:4.6.0:rc1:*:*:*:*:*:*