CVE-2011-3378: Rpm

High severity, CVSS 9.3. EPSS: 5.9% chance of exploitation in the next 30 days.

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

Affected products

• Rpm Rpm: up to and including 4.9.1.1; version 4.4.2 only; version 4.4.2. only; version 4.4.2.1 only; version 4.4.2.2 only; version 4.4.2.3 only; …

Published 2011-12-24. Last modified 2026-06-16.