CVE-2014-8118
HighSummary
Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.
Risk Assessment
Attackers can exploit this vulnerability to execute arbitrary code remotely, posing a serious threat to the integrity and confidentiality of the system.
Recommendation
It is recommended to upgrade RPM to a version newer than 4.12 to mitigate this vulnerability.
Other vulnerabilities in RPM
See all- CVE-2017-7501High
Versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with the ability to write in a directory where files will be installed could create symbolic links to an arbitrary location, potentially modifying content and permissions of arbitrary files.
- CVE-2013-6435High
A race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file. The issue is that the installation extracts the contents to temporary files before validating the signature.
- CVE-2026-78367High
A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression.
- CVE-2026-44605Medium
A heap buffer overflow vulnerability was found in RPM Package Manager when processing a specially crafted NDB database file. The issue arises from incorrect memory allocation during file parsing. A local user could exploit this to cause a denial of service, making the system unavailable.
Original NVD description (English source)
Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.