CVE-2012-0061: Rpm

Medium severity, CVSS 6.8. EPSS: 4.3% chance of exploitation in the next 30 days.

The headerLoad function in lib/header.c in RPM before 4.9.1.3 does not properly validate region tags, which allows user-assisted remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a large region size in a package header.

Affected products

• Rpm Rpm: up to and including 4.9.1.2; version 1.2 only; version 1.3 only; version 1.3.1 only; version 1.4 only; version 1.4.1 only; …

Published 2012-06-04. Last modified 2026-06-16.