CVE-2012-0060: Rpm

Medium severity, CVSS 6.8. EPSS: 4.3% chance of exploitation in the next 30 days.

RPM before 4.9.1.3 does not properly validate region tags, which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad, (2) rpmReadSignature, or (3) headerVerify function.

Affected products

• Rpm Rpm: up to and including 4.9.1.2; version 1.2 only; version 1.3 only; version 1.3.1 only; version 1.4 only; version 1.4.1 only; …

Published 2012-06-04. Last modified 2026-06-16.