RHSA-2011:1349: Important: rpm security update
The RPM Package Manager (RPM) is a command line driven package managementsystem capable of installing, uninstalling, verifying, querying, andupdating software packages.Multiple flaws were found in the way the RPM library parsed packageheaders. An attacker could create a specially-crafted RPM package that,when queried or installed, would cause rpm to crash or, potentially,execute arbitrary code. (CVE-2011-3378)Note: Although an RPM package can, by design, execute arbitrary code wheninstalled, this issue would allow a specially-crafted RPM package toexecute arbitrary code before its digital signature has been verified.Package downloads from the Red Hat Network remain secure due to certificatechecks performed on the secure connection.All RPM users should upgrade to these updated packages, which contain abackported patch to correct these issues. All running applications linkedagainst the RPM library must be restarted for this update to take effect.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2011:1349?
RHSA-2011:1349 is classified as an important security vulnerability.
How do I fix RHSA-2011:1349?
To fix RHSA-2011:1349, you should update the RPM package to version 4.8.0-16.el6_1.1 or its equivalent for your system.
What are the affected software packages for RHSA-2011:1349?
The affected software packages include RPM, RPM-debuginfo, RPM-devel, and others in various versions and architectures.
What types of attacks does RHSA-2011:1349 address?
RHSA-2011:1349 addresses vulnerabilities that could allow an attacker to create malicious RPM packages and execute arbitrary code.
Is there a risk of data loss with RHSA-2011:1349?
Yes, exploitation of RHSA-2011:1349 could potentially lead to data loss or unauthorized access to sensitive information.