7181 2015-01-19 09:02:50 +0000 rpm: CVE-2014-8118 & CVE-2013-6435 2015-08-12 22:06:42 +0000 1 1 7 Build System, Metadata & Runtime OE-Core devtools / tool chain unspecified All Multiple RESOLVED FIXED Medium normal 1.8.1 1 sona.sarmadi leonardo.sandoval.gonzalez leonardo.sandoval.gonzalez meta.mr.watcher meta.watcher --- --- No (bug/feature does not impact docs) oldest_to_newest 48023 0 sona.sarmadi 2015-01-19 09:02:50 +0000 Two vulnerabilities in RPM: CVE-2014-8118 integer overflow and stack overflow in CPIO header parsing CVE-2013-6435 race condition during the installation process From the Red Hat advisory: It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and extracts commands from it. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation. (CVE-2013-6435) It was found that RPM could encounter an integer overflow, leading to a stack-based buffer overflow, while parsing a crafted CPIO header in the payload section of an RPM file. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation. (CVE-2014-8118) References: https://bugzilla.redhat.com/show_bug.cgi?id=1168715 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6435 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8118 48042 1 mark.hatle 2015-01-19 16:01:01 +0000 I spoke w/ Jeff Johnson the RPM5 maintainer. He forwarded me the following: CVE-2014-8118: rpm5 unaffected afaict because: 1) size_t not int (so no integer overflow) 2) malloc'd not automatic stack based input buffer 3) check on buffer overrun So unless someone has a reproducer that affects RPM5, this CVE does not apply. 50572 2 mark.hatle 2015-04-28 18:25:54 +0000 Saul, we need someone assigned to investigate any security impact on the RPM4 implemented in 1.8 and master. 51970 3 leonardo.sandoval.gonzalez 2015-06-26 20:04:31 +0000 Now, on master db34474679587502fe0b6a0a5cd72351e29991a2 rpm: Fix CVE-2013-6435 3886107521ed64d72afb93bfc123f2b81bc4e959 rpm: Fix CVE-2014-8118 53063 4 leonardo.sandoval.gonzalez 2015-08-12 22:06:42 +0000 Commits on master branch: db34474679587502fe0b6a0a5cd72351e29991a2 Leonardo Sandoval Wed Jun 10 14:58:38 2015 +0000 rpm: Fix CVE-2013-6435 3886107521ed64d72afb93bfc123f2b81bc4e959 Leonardo Sandoval Wed Jun 10 14:55:14 2015 +0000 rpm: Fix CVE-2014-8118