CVE-2021-35937

概要

参考情報

• access.redhat.com/security/cve/CVE-2021-35937 · Vendor Advisory
• bugzilla.redhat.com/show_bug.cgi · Issue Tracking
• rpm.org/wiki/Releases/4.18.0 · Release Notes
• security.gentoo.org/glsa/202210-22 · Third Party Advisory
• usenix.org/legacy/event/sec05/tech/full_papers/borisov/borisov.pdf · Exploit

rpm のその他の脆弱性

• CVE-2021-35939中 6.7It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the…
• CVE-2021-35938中 6.7A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unp…
• CVE-2021-3521中 4.7There is a flaw in RPM's signature functionality. OpenPGP subkeys are associated with a primary key via a "binding signature." RPM does not …
• CVE-2021-3421中 5.5A flaw was found in the RPM package in the read functionality. This flaw allows an attacker who can convince a victim to install a seemingly…
• CVE-2021-20266中 4.9A flaw was found in RPM's hdrblobInit() in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds rea…