CVE-2010-2198
Summary
| CVE | CVE-2010-2198 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2010-06-08 18:30:10 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | lib/fsm.c in RPM 4.8.0 and earlier does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade or deletion of the file in an RPM package removal, which might allow local users to gain privileges or bypass intended access restrictions by creating a hard link to a vulnerable file that has (1) POSIX file capabilities or (2) SELinux context information, a related issue to CVE-2010-2059. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:L/AC:L/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Rpm | Rpm | 1.2 | All | All | All |
| Application | Rpm | Rpm | 1.3 | All | All | All |
| Application | Rpm | Rpm | 1.3.1 | All | All | All |
| Application | Rpm | Rpm | 1.4 | All | All | All |
| Application | Rpm | Rpm | 1.4.2 | All | All | All |
| Application | Rpm | Rpm | 1.4.2\/a | All | All | All |
| Application | Rpm | Rpm | 1.4.3 | All | All | All |
| Application | Rpm | Rpm | 1.4.4 | All | All | All |
| Application | Rpm | Rpm | 1.4.5 | All | All | All |
| Application | Rpm | Rpm | 1.4.6 | All | All | All |
| Application | Rpm | Rpm | 1.4.7 | All | All | All |
| Application | Rpm | Rpm | 2..4.10 | All | All | All |
| Application | Rpm | Rpm | 2.0 | All | All | All |
| Application | Rpm | Rpm | 2.0.1 | All | All | All |
| Application | Rpm | Rpm | 2.0.10 | All | All | All |
| Application | Rpm | Rpm | 2.0.11 | All | All | All |
| Application | Rpm | Rpm | 2.0.2 | All | All | All |
| Application | Rpm | Rpm | 2.0.3 | All | All | All |
| Application | Rpm | Rpm | 2.0.4 | All | All | All |
| Application | Rpm | Rpm | 2.0.5 | All | All | All |
| Application | Rpm | Rpm | 2.0.6 | All | All | All |
| Application | Rpm | Rpm | 2.0.7 | All | All | All |
| Application | Rpm | Rpm | 2.0.8 | All | All | All |
| Application | Rpm | Rpm | 2.0.9 | All | All | All |
| Application | Rpm | Rpm | 2.1 | All | All | All |
| Application | Rpm | Rpm | 2.1.1 | All | All | All |
| Application | Rpm | Rpm | 2.1.2 | All | All | All |
| Application | Rpm | Rpm | 2.2 | All | All | All |
| Application | Rpm | Rpm | 2.2.1 | All | All | All |
| Application | Rpm | Rpm | 2.2.10 | All | All | All |
| Application | Rpm | Rpm | 2.2.11 | All | All | All |
| Application | Rpm | Rpm | 2.2.2 | All | All | All |
| Application | Rpm | Rpm | 2.2.3 | All | All | All |
| Application | Rpm | Rpm | 2.2.3.10 | All | All | All |
| Application | Rpm | Rpm | 2.2.3.11 | All | All | All |
| Application | Rpm | Rpm | 2.2.4 | All | All | All |
| Application | Rpm | Rpm | 2.2.5 | All | All | All |
| Application | Rpm | Rpm | 2.2.6 | All | All | All |
| Application | Rpm | Rpm | 2.2.7 | All | All | All |
| Application | Rpm | Rpm | 2.2.8 | All | All | All |
| Application | Rpm | Rpm | 2.2.9 | All | All | All |
| Application | Rpm | Rpm | 2.3 | All | All | All |
| Application | Rpm | Rpm | 2.3.1 | All | All | All |
| Application | Rpm | Rpm | 2.3.2 | All | All | All |
| Application | Rpm | Rpm | 2.3.3 | All | All | All |
| Application | Rpm | Rpm | 2.3.4 | All | All | All |
| Application | Rpm | Rpm | 2.3.5 | All | All | All |
| Application | Rpm | Rpm | 2.3.6 | All | All | All |
| Application | Rpm | Rpm | 2.3.7 | All | All | All |
| Application | Rpm | Rpm | 2.3.8 | All | All | All |
| Application | Rpm | Rpm | 2.3.9 | All | All | All |
| Application | Rpm | Rpm | 2.4.1 | All | All | All |
| Application | Rpm | Rpm | 2.4.11 | All | All | All |
| Application | Rpm | Rpm | 2.4.12 | All | All | All |
| Application | Rpm | Rpm | 2.4.2 | All | All | All |
| Application | Rpm | Rpm | 2.4.3 | All | All | All |
| Application | Rpm | Rpm | 2.4.4 | All | All | All |
| Application | Rpm | Rpm | 2.4.5 | All | All | All |
| Application | Rpm | Rpm | 2.4.6 | All | All | All |
| Application | Rpm | Rpm | 2.4.8 | All | All | All |
| Application | Rpm | Rpm | 2.4.9 | All | All | All |
| Application | Rpm | Rpm | 2.5 | All | All | All |
| Application | Rpm | Rpm | 2.5.1 | All | All | All |
| Application | Rpm | Rpm | 2.5.2 | All | All | All |
| Application | Rpm | Rpm | 2.5.3 | All | All | All |
| Application | Rpm | Rpm | 2.5.4 | All | All | All |
| Application | Rpm | Rpm | 2.5.5 | All | All | All |
| Application | Rpm | Rpm | 2.5.6 | All | All | All |
| Application | Rpm | Rpm | 2.6.7 | All | All | All |
| Application | Rpm | Rpm | 3.0 | All | All | All |
| Application | Rpm | Rpm | 3.0.1 | All | All | All |
| Application | Rpm | Rpm | 3.0.2 | All | All | All |
| Application | Rpm | Rpm | 3.0.3 | All | All | All |
| Application | Rpm | Rpm | 3.0.4 | All | All | All |
| Application | Rpm | Rpm | 3.0.5 | All | All | All |
| Application | Rpm | Rpm | 3.0.6 | All | All | All |
| Application | Rpm | Rpm | 4.0. | All | All | All |
| Application | Rpm | Rpm | 4.0.1 | All | All | All |
| Application | Rpm | Rpm | 4.0.2 | All | All | All |
| Application | Rpm | Rpm | 4.0.3 | All | All | All |
| Application | Rpm | Rpm | 4.0.4 | All | All | All |
| Application | Rpm | Rpm | 4.1 | All | All | All |
| Application | Rpm | Rpm | 4.3.3 | All | All | All |
| Application | Rpm | Rpm | 4.4.2 | All | All | All |
| Application | Rpm | Rpm | 4.4.2.1 | All | All | All |
| Application | Rpm | Rpm | 4.4.2.2 | All | All | All |
| Application | Rpm | Rpm | 4.4.2.3 | All | All | All |
| Application | Rpm | Rpm | 4.6.0 | All | All | All |
| Application | Rpm | Rpm | 4.6.1 | All | All | All |
| Application | Rpm | Rpm | 4.7.0 | All | All | All |
| Application | Rpm | Rpm | 4.7.1 | All | All | All |
| Application | Rpm | Rpm | 4.7.2 | All | All | All |
| Application | Rpm | Rpm | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Bug 598775 – CVE-2010-2059 rpm: fails to drop SUID/SGID bits on package upgrade | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | |
| 'Re: [oss-security] CVE Request -- rpm -- Fails to remove the' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| oss-security - Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| oss-security - Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| www.osvdb.org/65144 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| RPM Package Manager Package Upgrade File Metadata Update Weaknesses - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| rpm.org Git Repositories - rpm.git/commit | af854a3a-2127-422b-91ae-364da2661108 | rpm.org | |
| oss-security - Re: CVE Request -- rpm -- Fails to remove the SUID/SGID bits on package upgrade (RH BZ#598775) | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| rpm.org Git Repositories - rpm.git/commit | MITRE | rpm.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.