https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 17:49:38 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:0463 <p><strong>Affected:</strong> AlmaLinux:9: python3-rpm, AlmaLinux:9: rpm, AlmaLinux:9: rpm-apidocs, AlmaLinux:9: rpm-build, AlmaLinux:9: rpm-build-libs, AlmaLinux:9: rpm-cron, AlmaLinux:9: rpm-devel, AlmaLinux:9: rpm-libs, AlmaLinux:9: rpm-plugin-audit, AlmaLinux:9: rpm-plugin-fapolicyd and 6 more</p> <p>The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.</p> <p>Security Fix(es):</p> <p>* rpm: TOCTOU race in checks for unsafe symlinks (CVE-2021-35937) * rpm: races with chown/chmod/capabilities calls during installation (CVE-2021-35938) * rpm: checks for unsafe symlinks are not performed for intermediary directories (CVE-2021-35939)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:9: python3-rpm, AlmaLinux:9: rpm, AlmaLinux:9: rpm-apidocs, AlmaLinux:9: rpm-build, AlmaLinux:9: rpm-build-libs, AlmaLinux:9: rpm-cron, AlmaLinux:9: rpm-devel, AlmaLinux:9: rpm-libs, AlmaLinux:9: rpm-plugin-audit, AlmaLinux:9: rpm-plugin-fapolicyd and 6 more</p> <p>The RPM Package Manager (RPM) is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.</p> <p>Security Fix(es):</p> <p>* rpm: TOCTOU race in checks for unsafe symlinks (CVE-2021-35937) * rpm: races with chown/chmod/capabilities calls during installation (CVE-2021-35938) * rpm: checks for unsafe symlinks are not performed for intermediary directories (CVE-2021-35939)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:0463 https://cve.radiocsirt.org/vuln/bdu:2021-03569 bdu:2021-03569 https://cve.radiocsirt.org/vuln/bdu:2021-03569 https://cve.radiocsirt.org/vuln/bell-cve-2021-35938 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2021-35938 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0305 certfr-2024-avi-0305 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0305 https://cve.radiocsirt.org/vuln/euvd-2026-29265 EUVD-2026-29265 https://cve.radiocsirt.org/vuln/euvd-2026-29265 https://cve.radiocsirt.org/vuln/fkie_cve-2021-35938 <p>A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.</p> <p>A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-35938 https://cve.radiocsirt.org/vuln/ghsa-83gm-5269-qr3v <p>A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.</p> <p>A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.</p> https://cve.radiocsirt.org/vuln/ghsa-83gm-5269-qr3v https://cve.radiocsirt.org/vuln/gsd-2021-35938 gsd-2021-35938 https://cve.radiocsirt.org/vuln/gsd-2021-35938 https://cve.radiocsirt.org/vuln/msrc_cve-2021-35938 msrc_CVE-2021-35938 https://cve.radiocsirt.org/vuln/msrc_cve-2021-35938 https://cve.radiocsirt.org/vuln/oesa-2022-1897 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: rpm, openEuler:20.03-LTS-SP3: rpm, openEuler:22.03-LTS: rpm</p> <p>The RPM Package Manager (RPM) is a powerful package management system capability as below Security Fix(es): A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2021-35937) It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2021-35939) A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2021-35938)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: rpm, openEuler:20.03-LTS-SP3: rpm, openEuler:22.03-LTS: rpm</p> <p>The RPM Package Manager (RPM) is a powerful package management system capability as below Security Fix(es): A race condition vulnerability was found in rpm. A local unprivileged user could use this flaw to bypass the checks that were introduced in response to CVE-2017-7500 and CVE-2017-7501, potentially gaining root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2021-35937) It was found that the fix for CVE-2017-7500 and CVE-2017-7501 was incomplete: the check was only implemented for the parent directory of the file to be created. A local unprivileged user who owns another ancestor directory could potentially use this flaw to gain root privileges. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2021-35939) A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.(CVE-2021-35938)</p> https://cve.radiocsirt.org/vuln/oesa-2022-1897 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12562-1 <p>librpmbuild9-4.18.0-1.1 on GA media</p> <p>librpmbuild9-4.18.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:12562-1 https://cve.radiocsirt.org/vuln/rhsa-2024:0424 <p>rpm: TOCTOU race in checks for unsafe symlinks rpm: races with chown/chmod/capabilities calls during installation rpm: checks for unsafe symlinks are not performed for intermediary directories</p> <p>rpm: TOCTOU race in checks for unsafe symlinks rpm: races with chown/chmod/capabilities calls during installation rpm: checks for unsafe symlinks are not performed for intermediary directories</p> https://cve.radiocsirt.org/vuln/rhsa-2024:0424 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-35938 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rpm, Ubuntu:Pro:16.04:LTS: rpm, Ubuntu:Pro:18.04:LTS: rpm, Ubuntu:Pro:20.04:LTS: rpm, Ubuntu:22.04:LTS: rpm, Ubuntu:24.04:LTS: rpm, Ubuntu:25.10: rpm, Ubuntu:26.04:LTS: rpm</p> <p>A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: rpm, Ubuntu:Pro:16.04:LTS: rpm, Ubuntu:Pro:18.04:LTS: rpm, Ubuntu:Pro:20.04:LTS: rpm, Ubuntu:22.04:LTS: rpm, Ubuntu:24.04:LTS: rpm, Ubuntu:25.10: rpm, Ubuntu:26.04:LTS: rpm</p> <p>A symbolic link issue was found in rpm. It occurs when rpm sets the desired permissions and credentials after installing a file. A local unprivileged user could use this flaw to exchange the original file with a symbolic link to a security-critical file and escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-35938 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1243 <p>Ein lokaler Angreifer kann mehrere Schwachstellen in RPM ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Dateien zu manipulieren oder sonstige Auswirkungen zu verursachen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen in RPM ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Dateien zu manipulieren oder sonstige Auswirkungen zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-1243