Two vulnerabilities in RPM: CVE-2014-8118 integer overflow and stack overflow in CPIO header parsing CVE-2013-6435 race condition during the installation process From the Red Hat advisory: It was found that RPM wrote file contents to the target installation directory under a temporary name, and verified its cryptographic signature only after the temporary file has been written completely. Under certain conditions, the system interprets the unverified temporary file contents and extracts commands from it. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation. (CVE-2013-6435) It was found that RPM could encounter an integer overflow, leading to a stack-based buffer overflow, while parsing a crafted CPIO header in the payload section of an RPM file. This could allow an attacker to modify signed RPM files in such a way that they would execute code chosen by the attacker during package installation. (CVE-2014-8118) References: https://bugzilla.redhat.com/show_bug.cgi?id=1168715 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6435 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8118
I spoke w/ Jeff Johnson the RPM5 maintainer. He forwarded me the following: CVE-2014-8118: rpm5 unaffected afaict because: 1) size_t not int (so no integer overflow) 2) malloc'd not automatic stack based input buffer 3) check on buffer overrun So unless someone has a reproducer that affects RPM5, this CVE does not apply.
Saul, we need someone assigned to investigate any security impact on the RPM4 implemented in 1.8 and master.
Now, on master db34474679587502fe0b6a0a5cd72351e29991a2 rpm: Fix CVE-2013-6435 3886107521ed64d72afb93bfc123f2b81bc4e959 rpm: Fix CVE-2014-8118
Commits on master branch: db34474679587502fe0b6a0a5cd72351e29991a2 Leonardo Sandoval Wed Jun 10 14:58:38 2015 +0000 rpm: Fix CVE-2013-6435 3886107521ed64d72afb93bfc123f2b81bc4e959 Leonardo Sandoval Wed Jun 10 14:55:14 2015 +0000 rpm: Fix CVE-2014-8118