7.6
CVE-2013-6435
- EPSS 7.67%
- Veröffentlicht 16.12.2014 18:59:00
- Zuletzt bearbeitet 06.05.2026 22:30:45
- Quelle secalert@redhat.com
- CVE-Watchlists
- Unerledigt
LoginRace condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Debian ≫ Debian Linux Version7.0
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 7.67% | 0.938 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.6 | 4.9 | 10 |
AV:N/AC:H/Au:N/C:C/I:C/A:C
|
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://www.oracle.com/technetwork/topics/security/ovmbulletinjul2016-3090546.html
http://advisories.mageia.org/MGASA-2014-0529.html
http://rhn.redhat.com/errata/RHSA-2014-1974.html
http://rhn.redhat.com/errata/RHSA-2014-1975.html
http://rhn.redhat.com/errata/RHSA-2014-1976.html
http://www.debian.org/security/2015/dsa-3129
http://www.mandriva.com/security/advisories?name=MDVSA-2014:251
http://www.mandriva.com/security/advisories?name=MDVSA-2015:056
http://www.securityfocus.com/bid/71558
https://bugzilla.redhat.com/show_bug.cgi?id=1039811
https://security.gentoo.org/glsa/201811-22
https://securityblog.redhat.com/2014/12/10/analysis-of-the-cve-2013-6435-flaw-in-rpm/