Every CVE Search/ Get API key

CVE-2005-4889

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during...

7.2 HighFix available

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file, a related issue to CVE-2010-2059.

Exploit likelihood

0.32%Down 0.6 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.2

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file, a related issue to CVE-2010-2059.

Record
CVE-2005-4889
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file, a related issue to CVE-2010-2059.

Record
CVE-2005-4889
Updated
2026-11-02
EUVDEUVD-2005-4880 No score

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file, a related issue to CVE-2010-2059.

Record
EUVD-2005-4880
Updated
2026-11-03
GitHub AdvisoriesGHSA-pfqv-vjx4-pmxj No score

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during...

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file, a related issue to CVE-2010-2059.

Record
GHSA-pfqv-vjx4-pmxj
Updated
2026-11-02
OSV No score

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file, a related issue to CVE-2010-2059.

Record
CVE-2005-4889
Updated
2026-11-02
OSVDEBIAN-CVE-2005-4889 No score

lib/fsm.c in RPM before 4.4.3 does not properly reset the metadata of an executable file during deletion of the file in an RPM package removal, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file, a related issue to CVE-2010-2059.

Record
DEBIAN-CVE-2005-4889
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rpm
Debian:12
 before 4.7.0-1
4.7.0-1
rpm
Debian:13
 before 4.7.0-1
4.7.0-1
rpm
Debian:14
 before 4.7.0-1
4.7.0-1
popt
Red Hat:enterprise_linux:4::as
 before 0:1.9.1-33_nonptl.el4_8.1
0:1.9.1-33_nonptl.el4_8.1
rpm
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-build
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-devel
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-libs
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-python
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
Show 21 moreShow less
Affected packages
PackageAffectedFixed
popt
Red Hat:enterprise_linux:4::desktop
 before 0:1.9.1-33_nonptl.el4_8.1
0:1.9.1-33_nonptl.el4_8.1
rpm
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-build
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-devel
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-libs
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-python
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
popt
Red Hat:enterprise_linux:4::es
 before 0:1.9.1-33_nonptl.el4_8.1
0:1.9.1-33_nonptl.el4_8.1
rpm
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-build
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-devel
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-libs
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-python
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
popt
Red Hat:enterprise_linux:4::ws
 before 0:1.9.1-33_nonptl.el4_8.1
0:1.9.1-33_nonptl.el4_8.1
rpm
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-build
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-devel
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-libs
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-python
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2005-4889 is a high vulnerability (CVSS 7.2) in Rpm, published June 8, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.32%, the 25th percentile. Fixed in rpm 4.7.0-1.

References

Show 11 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open