CVE-2013-6435
Summary
| CVE | CVE-2013-6435 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-12-16 18:59:00 UTC |
| Updated | 2026-05-06 22:30:45 UTC |
| Description | Race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file whose installation extracts the contents to temporary files before validating the signature, as demonstrated by installing a file in the /etc/cron.d directory. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
HighAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:N/AC:H/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 7.0 | All | All | All |
| Application | Rpm | Rpm | 1.2 | All | All | All |
| Application | Rpm | Rpm | 1.3 | All | All | All |
| Application | Rpm | Rpm | 1.3.1 | All | All | All |
| Application | Rpm | Rpm | 1.4 | All | All | All |
| Application | Rpm | Rpm | 1.4.1 | All | All | All |
| Application | Rpm | Rpm | 1.4.2 | All | All | All |
| Application | Rpm | Rpm | 1.4.2\/a | All | All | All |
| Application | Rpm | Rpm | 1.4.3 | All | All | All |
| Application | Rpm | Rpm | 1.4.4 | All | All | All |
| Application | Rpm | Rpm | 1.4.5 | All | All | All |
| Application | Rpm | Rpm | 1.4.6 | All | All | All |
| Application | Rpm | Rpm | 1.4.7 | All | All | All |
| Application | Rpm | Rpm | 2.0 | All | All | All |
| Application | Rpm | Rpm | 2.0.1 | All | All | All |
| Application | Rpm | Rpm | 2.0.10 | All | All | All |
| Application | Rpm | Rpm | 2.0.11 | All | All | All |
| Application | Rpm | Rpm | 2.0.2 | All | All | All |
| Application | Rpm | Rpm | 2.0.3 | All | All | All |
| Application | Rpm | Rpm | 2.0.4 | All | All | All |
| Application | Rpm | Rpm | 2.0.5 | All | All | All |
| Application | Rpm | Rpm | 2.0.6 | All | All | All |
| Application | Rpm | Rpm | 2.0.7 | All | All | All |
| Application | Rpm | Rpm | 2.0.8 | All | All | All |
| Application | Rpm | Rpm | 2.0.9 | All | All | All |
| Application | Rpm | Rpm | 2.1 | All | All | All |
| Application | Rpm | Rpm | 2.1.1 | All | All | All |
| Application | Rpm | Rpm | 2.1.2 | All | All | All |
| Application | Rpm | Rpm | 2.2 | All | All | All |
| Application | Rpm | Rpm | 2.2.1 | All | All | All |
| Application | Rpm | Rpm | 2.2.10 | All | All | All |
| Application | Rpm | Rpm | 2.2.11 | All | All | All |
| Application | Rpm | Rpm | 2.2.2 | All | All | All |
| Application | Rpm | Rpm | 2.2.3 | All | All | All |
| Application | Rpm | Rpm | 2.2.3.10 | All | All | All |
| Application | Rpm | Rpm | 2.2.3.11 | All | All | All |
| Application | Rpm | Rpm | 2.2.4 | All | All | All |
| Application | Rpm | Rpm | 2.2.5 | All | All | All |
| Application | Rpm | Rpm | 2.2.6 | All | All | All |
| Application | Rpm | Rpm | 2.2.7 | All | All | All |
| Application | Rpm | Rpm | 2.2.8 | All | All | All |
| Application | Rpm | Rpm | 2.2.9 | All | All | All |
| Application | Rpm | Rpm | 2.3 | All | All | All |
| Application | Rpm | Rpm | 2.3.1 | All | All | All |
| Application | Rpm | Rpm | 2.3.2 | All | All | All |
| Application | Rpm | Rpm | 2.3.3 | All | All | All |
| Application | Rpm | Rpm | 2.3.4 | All | All | All |
| Application | Rpm | Rpm | 2.3.5 | All | All | All |
| Application | Rpm | Rpm | 2.3.6 | All | All | All |
| Application | Rpm | Rpm | 2.3.7 | All | All | All |
| Application | Rpm | Rpm | 2.3.8 | All | All | All |
| Application | Rpm | Rpm | 2.3.9 | All | All | All |
| Application | Rpm | Rpm | 2.4.1 | All | All | All |
| Application | Rpm | Rpm | 2.4.11 | All | All | All |
| Application | Rpm | Rpm | 2.4.12 | All | All | All |
| Application | Rpm | Rpm | 2.4.2 | All | All | All |
| Application | Rpm | Rpm | 2.4.3 | All | All | All |
| Application | Rpm | Rpm | 2.4.4 | All | All | All |
| Application | Rpm | Rpm | 2.4.5 | All | All | All |
| Application | Rpm | Rpm | 2.4.6 | All | All | All |
| Application | Rpm | Rpm | 2.4.8 | All | All | All |
| Application | Rpm | Rpm | 2.4.9 | All | All | All |
| Application | Rpm | Rpm | 2.5 | All | All | All |
| Application | Rpm | Rpm | 2.5.1 | All | All | All |
| Application | Rpm | Rpm | 2.5.2 | All | All | All |
| Application | Rpm | Rpm | 2.5.3 | All | All | All |
| Application | Rpm | Rpm | 2.5.4 | All | All | All |
| Application | Rpm | Rpm | 2.5.5 | All | All | All |
| Application | Rpm | Rpm | 2.5.6 | All | All | All |
| Application | Rpm | Rpm | 2.6.7 | All | All | All |
| Application | Rpm | Rpm | 3.0 | All | All | All |
| Application | Rpm | Rpm | 3.0.1 | All | All | All |
| Application | Rpm | Rpm | 3.0.2 | All | All | All |
| Application | Rpm | Rpm | 3.0.3 | All | All | All |
| Application | Rpm | Rpm | 3.0.4 | All | All | All |
| Application | Rpm | Rpm | 3.0.5 | All | All | All |
| Application | Rpm | Rpm | 3.0.6 | All | All | All |
| Application | Rpm | Rpm | 4.0. | All | All | All |
| Application | Rpm | Rpm | 4.0.1 | All | All | All |
| Application | Rpm | Rpm | 4.0.2 | All | All | All |
| Application | Rpm | Rpm | 4.0.3 | All | All | All |
| Application | Rpm | Rpm | 4.0.4 | All | All | All |
| Application | Rpm | Rpm | 4.1 | All | All | All |
| Application | Rpm | Rpm | 4.10.0 | All | All | All |
| Application | Rpm | Rpm | 4.10.1 | All | All | All |
| Application | Rpm | Rpm | 4.10.2 | All | All | All |
| Application | Rpm | Rpm | 4.3.3 | All | All | All |
| Application | Rpm | Rpm | 4.4.2.1 | All | All | All |
| Application | Rpm | Rpm | 4.4.2.2 | All | All | All |
| Application | Rpm | Rpm | 4.4.2.3 | All | All | All |
| Application | Rpm | Rpm | 4.5.90 | All | All | All |
| Application | Rpm | Rpm | 4.6.0 | All | All | All |
| Application | Rpm | Rpm | 4.6.0 | rc1 | All | All |
| Application | Rpm | Rpm | 4.6.0 | rc2 | All | All |
| Application | Rpm | Rpm | 4.6.0 | rc3 | All | All |
| Application | Rpm | Rpm | 4.6.0 | rc4 | All | All |
| Application | Rpm | Rpm | 4.6.1 | All | All | All |
| Application | Rpm | Rpm | 4.7.0 | All | All | All |
| Application | Rpm | Rpm | 4.7.1 | All | All | All |
| Application | Rpm | Rpm | 4.7.2 | All | All | All |
| Application | Rpm | Rpm | 4.8.0 | All | All | All |
| Application | Rpm | Rpm | 4.8.1 | All | All | All |
| Application | Rpm | Rpm | 4.9.0 | All | All | All |
| Application | Rpm | Rpm | 4.9.0 | alpha | All | All |
| Application | Rpm | Rpm | 4.9.0 | beta1 | All | All |
| Application | Rpm | Rpm | 4.9.0 | rc1 | All | All |
| Application | Rpm | Rpm | 4.9.1 | All | All | All |
| Application | Rpm | Rpm | 4.9.1.1 | All | All | All |
| Application | Rpm | Rpm | 4.9.1.2 | All | All | All |
| Application | Rpm | Rpm | All | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Analysis of the CVE-2013-6435 Flaw in RPM | Red Hat Security | af854a3a-2127-422b-91ae-364da2661108 | securityblog.redhat.com | |
| RPM CVE-2013-6435 Remote Code Execution Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Debian -- Security Information -- DSA-3129-1 rpm | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Support / Security / Advisories / / MDVSA-2015:056 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| Oracle VM Server for x86 Bulletin - July 2016 | af854a3a-2127-422b-91ae-364da2661108 | www.oracle.com | |
| Bug 1039811 – CVE-2013-6435 rpm: race condition during the installation process | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | |
| Support / Security / Advisories / / MDVSA-2014:251 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| RPM: Multiple vulnerabilities (GLSA 201811-22) — Gentoo security | af854a3a-2127-422b-91ae-364da2661108 | security.gentoo.org | |
| Mageia Advisory: MGASA-2014-0529 - Updated rpm packages fix security vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | advisories.mageia.org | |
| Juniper Networks - 2015-10 Security Bulletin: CTPView: Multiple Vulnerabilities in CTPView | af854a3a-2127-422b-91ae-364da2661108 | kb.juniper.net | |
| Red Hat Customer Portal | af854a3a-2127-422b-91ae-364da2661108 | rhn.redhat.com | |
| Red Hat Customer Portal | MITRE | access.redhat.com | |
| Red Hat Customer Portal | MITRE | access.redhat.com | |
| Red Hat Customer Portal | MITRE | access.redhat.com | |
| access.redhat.com | CVE-2013-6435 | MITRE | access.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 710222 Gentoo Linux RPM Multiple Vulnerabilities (GLSA 201811-22)