CVE-2012-0061
The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.
- EPSS
- 4.3% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- rpm:rpm
References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/077960.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078819.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-April/078907.html
- http://rhn.redhat.com/errata/RHSA-2012-0451.html
- http://rhn.redhat.com/errata/RHSA-2012-0531.html