[ glsa 201811-22 ] rpm

[GLSA]

Gentoo Linux Security Advisory

Title: RPM: Multiple vulnerabilities (GLSA 201811-22)
Severity: normal
Exploitable: remote
Date: 2018-11-28
Bug(s): #533740, #638636
ID: 201811-22

Synopsis

Multiple vulnerabilities have been found in RPM, the worst of which
could allow a remote attacker to escalate privileges.


Background

The Red Hat Package Manager (RPM) is a command line driven package
management system capable of installing, uninstalling, verifying,
querying, and updating computer software packages.


Affected Packages

Package: app-arch/rpm
Vulnerable: < 4.14.1
Unaffected: >= 4.14.1
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in RPM. Please review the
CVE identifiers referenced below for details.


Impact

A remote attacker, by enticing the user to process a specially crafted
RPM file, could escalate privileges, execute arbitrary code, or cause a
Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All RPM users should upgrade to the latest version: