GCVE - cpe:2.3:a:rpm:rpm:4.0.1:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:rpm:rpm:4.0.1:*:*:*:*:*:*:*

part: a version: 4.0.1 update: *

Vendor	Rpm (`c01bad82-b6fe-5fb6-8e3f-74052dbedf9d`)
Product	Rpm (`bbede3a4-0f4c-5ee3-924b-b067fd84e0a2`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:deb/debian/rpm`	purl2cpe	2026-06-01 10:18:00.484631
`pkg:deb/ubuntu/rpm`	purl2cpe	2026-06-01 10:18:00.484632
`pkg:github/rpm-software-management/rpm`	purl2cpe	2026-06-01 10:18:00.484634
`pkg:gitlab/redhat/rpm`	purl2cpe	2026-06-01 10:18:00.484635
`pkg:rpm/rpm`	purl2cpe	2026-06-01 10:18:00.484637

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2014-8118`	vulnerable	2026-06-08 05:06:07.734882	Details available Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow. Published: 2014-12-16T18:00:00.000Z Updated: 2024-08-06T13:10:50.836Z Open on db.gcve.eu Reference links http://www.mandriva.com/security/advisories?name=MDVSA-2015:056 https://security.gentoo.org/glsa/201811-22 http://advisories.mageia.org/MGASA-2014-0529.html http://www.mandriva.com/security/advisories?name=MDVSA-2014:251 http://www.debian.org/security/2015/dsa-3129	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-6435`	vulnerable	2026-06-08 05:04:56.796266	Details available Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory. Published: 2014-12-16T18:00:00.000Z Updated: 2024-08-06T17:39:01.291Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://www.mandriva.com/security/advisories?name=MDVSA-2015:056 https://security.gentoo.org/glsa/201811-22 http://advisories.mageia.org/MGASA-2014-0529.html https://securityblog.redhat.com/2014/12/10/analysis-of-the-cve-2013-6435-flaw-in-rpm/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0815`	vulnerable	2026-06-08 05:00:45.577737	Details available The headerVerifyInfo function in lib/header.c in RPM before 4.9.1.3 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a negative value in a region offset of a package header, which is not properly handled in a numeric range comparison. Published: 2012-06-04T20:00:00.000Z Updated: 2024-08-06T18:38:14.851Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://rhn.redhat.com/errata/RHSA-2012-0531.html http://www.mandriva.com/security/advisories?name=MDVSA-2012:056 http://www.securitytracker.com/id?1026882 https://bugzilla.redhat.com/show_bug.cgi?id=744104	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0061`	vulnerable	2026-06-08 04:59:36.003236	Details available The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header. Published: 2012-06-04T20:00:00.000Z Updated: 2024-08-06T18:09:17.302Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://rhn.redhat.com/errata/RHSA-2012-0531.html http://www.mandriva.com/security/advisories?name=MDVSA-2012:056 http://www.securitytracker.com/id?1026882 http://rpm.org/wiki/Releases/4.9.1.3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2012-0060`	vulnerable	2026-06-08 04:59:35.983185	Details available RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function. Published: 2012-06-04T20:00:00.000Z Updated: 2024-08-06T18:09:17.306Z Open on db.gcve.eu Reference links http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html http://rhn.redhat.com/errata/RHSA-2012-0531.html http://www.mandriva.com/security/advisories?name=MDVSA-2012:056 http://www.securitytracker.com/id?1026882 http://rpm.org/wiki/Releases/4.9.1.3	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-2199`	vulnerable	2026-06-08 04:54:12.113958	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-2198`	vulnerable	2026-06-08 04:54:12.111662	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-2197`	vulnerable	2026-06-08 04:54:12.101340	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2010-2059`	vulnerable	2026-06-08 04:54:11.456259	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2005-4889`	vulnerable	2026-06-08 04:48:45.550261	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.