CVE-2013-6435

Published: 16 December 2014

Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory.

Status

References

• https://ubuntu.com/security/notices/USN-2479-1
• https://www.cve.org/CVERecord?id=CVE-2013-6435
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=1039811
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=773101