RPM vulnerabilities

Versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with the ability to write in a directory where files will be installed could create symbolic links to an arbitrary location, potentially modifying content and permissions of arbitrary files.

Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.

A race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file. The issue is that the installation extracts the contents to temporary files before validating the signature.

A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec() function in tools/rpmbuild.cc passes an attacker-controlled tar archive member name to rpmExpand() as part of a %{basename:...} macro expression.

A heap buffer overflow vulnerability was found in RPM Package Manager when processing a specially crafted NDB database file. The issue arises from incorrect memory allocation during file parsing. A local user could exploit this to cause a denial of service, making the system unavailable.