CVE-2013-6435
HighSummary
A race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file. The issue is that the installation extracts the contents to temporary files before validating the signature.
Risk Assessment
Attackers can exploit this vulnerability to introduce malicious code into the system, potentially leading to system takeover or data leakage.
Recommendation
It is recommended to update RPM to the latest version to mitigate this vulnerability and to verify the signatures of RPM files before installation.
Other vulnerabilities in RPM
See all- CVE-2017-7501High
Versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with the ability to write in a directory where files will be installed could create symbolic links to an arbitrary location, potentially modifying content and permissions of arbitrary files.
- CVE-2014-8118High
Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.
- CVE-2026-78367High
A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression.
- CVE-2026-44605Medium
A heap buffer overflow vulnerability was found in RPM Package Manager when processing a specially crafted NDB database file. The issue arises from incorrect memory allocation during file parsing. A local user could exploit this to cause a denial of service, making the system unavailable.
Original NVD description (English source)
Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory.