Every CVE Search/ Get API key

CVE-2011-3378

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of...

9.3 HighFix available

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

Exploit likelihood

5.92%Down 0.7 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 9.3

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

Record
CVE-2011-3378
CVSS 2.0
9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness
CWE-94
Updated
2026-11-02
CVE List No score

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

Record
CVE-2011-3378
Updated
2026-11-02
EUVDEUVD-2011-3341 No score

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

Record
EUVD-2011-3341
Updated
2026-11-03
GitHub AdvisoriesGHSA-34ff-v8wx-w9f5 No score

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of...

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

Record
GHSA-34ff-v8wx-w9f5
Weakness
CWE-94
Updated
2026-11-02
OSV No score

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

Record
CVE-2011-3378
Updated
2026-11-02
OSVDEBIAN-CVE-2011-3378 No score

RPM 4.4.x through 4.9.x, probably before 4.9.1.2, allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via an rpm package with crafted headers and offsets that are not properly handled when a package is queried or installed, related to (1) the regionSwab function, (2) the headerLoad function, and (3) multiple functions in rpmio/rpmpgp.c.

Record
DEBIAN-CVE-2011-3378
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rpm
Debian:12
 before 4.9.1.2-1
4.9.1.2-1
rpm
Debian:13
 before 4.9.1.2-1
4.9.1.2-1
rpm
Debian:14
 before 4.9.1.2-1
4.9.1.2-1
popt
Red Hat:rhel_els:3::as
 before 0:1.8.2-35_nonptl
0:1.8.2-35_nonptl
rpm
Red Hat:rhel_els:3::as
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
rpm-build
Red Hat:rhel_els:3::as
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
rpm-debuginfo
Red Hat:rhel_els:3::as
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
rpm-devel
Red Hat:rhel_els:3::as
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
rpm-libs
Red Hat:rhel_els:3::as
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
rpm-python
Red Hat:rhel_els:3::as
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
Show 77 moreShow less
Affected packages
PackageAffectedFixed
popt
Red Hat:rhel_els:3::es
 before 0:1.8.2-35_nonptl
0:1.8.2-35_nonptl
rpm
Red Hat:rhel_els:3::es
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
rpm-build
Red Hat:rhel_els:3::es
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
rpm-debuginfo
Red Hat:rhel_els:3::es
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
rpm-devel
Red Hat:rhel_els:3::es
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
rpm-libs
Red Hat:rhel_els:3::es
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
rpm-python
Red Hat:rhel_els:3::es
 before 0:4.2.3-35_nonptl
0:4.2.3-35_nonptl
popt
Red Hat:enterprise_linux:4::as
 before 0:1.9.1-35_nonptl.el4
0:1.9.1-35_nonptl.el4
rpm
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-build
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-debuginfo
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-devel
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-libs
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-python
Red Hat:enterprise_linux:4::as
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
popt
Red Hat:enterprise_linux:4::desktop
 before 0:1.9.1-35_nonptl.el4
0:1.9.1-35_nonptl.el4
rpm
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-build
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-debuginfo
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-devel
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-libs
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-python
Red Hat:enterprise_linux:4::desktop
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
popt
Red Hat:enterprise_linux:4::es
 before 0:1.9.1-35_nonptl.el4
0:1.9.1-35_nonptl.el4
rpm
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-build
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-debuginfo
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-devel
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-libs
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-python
Red Hat:enterprise_linux:4::es
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
popt
Red Hat:enterprise_linux:4::ws
 before 0:1.9.1-35_nonptl.el4
0:1.9.1-35_nonptl.el4
rpm
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-build
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-debuginfo
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-devel
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-libs
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
rpm-python
Red Hat:enterprise_linux:4::ws
 before 0:4.3.3-35_nonptl.el4
0:4.3.3-35_nonptl.el4
popt
Red Hat:enterprise_linux:5::client
 before 0:1.10.2.3-22.el5_7.2
0:1.10.2.3-22.el5_7.2
rpm
Red Hat:enterprise_linux:5::client
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-libs
Red Hat:enterprise_linux:5::client
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-python
Red Hat:enterprise_linux:5::client
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-apidocs
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-build
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
popt
Red Hat:rhel_mission_critical:5.3
 before 0:1.10.2.3-9.el5_3.2
0:1.10.2.3-9.el5_3.2
rpm
Red Hat:rhel_mission_critical:5.3
 before 0:4.4.2.3-9.el5_3.2
0:4.4.2.3-9.el5_3.2
rpm-apidocs
Red Hat:rhel_mission_critical:5.3
 before 0:4.4.2.3-9.el5_3.2
0:4.4.2.3-9.el5_3.2
rpm-build
Red Hat:rhel_mission_critical:5.3
 before 0:4.4.2.3-9.el5_3.2
0:4.4.2.3-9.el5_3.2
rpm-debuginfo
Red Hat:rhel_mission_critical:5.3
 before 0:4.4.2.3-9.el5_3.2
0:4.4.2.3-9.el5_3.2
rpm-devel
Red Hat:rhel_mission_critical:5.3
 before 0:4.4.2.3-9.el5_3.2
0:4.4.2.3-9.el5_3.2
rpm-libs
Red Hat:rhel_mission_critical:5.3
 before 0:4.4.2.3-9.el5_3.2
0:4.4.2.3-9.el5_3.2
rpm-python
Red Hat:rhel_mission_critical:5.3
 before 0:4.4.2.3-9.el5_3.2
0:4.4.2.3-9.el5_3.2
popt
Red Hat:enterprise_linux:5::server
 before 0:1.10.2.3-22.el5_7.2
0:1.10.2.3-22.el5_7.2
rpm
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-apidocs
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-build
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-devel
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-libs
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm-python
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-22.el5_7.2
0:4.4.2.3-22.el5_7.2
rpm
Red Hat:rhel_eus:6.0
 before 0:4.8.0-12.el6_0.1
0:4.8.0-12.el6_0.1
rpm-build
Red Hat:rhel_eus:6.0
 before 0:4.8.0-12.el6_0.1
0:4.8.0-12.el6_0.1
rpm-debuginfo
Red Hat:rhel_eus:6.0
 before 0:4.8.0-12.el6_0.1
0:4.8.0-12.el6_0.1
rpm-devel
Red Hat:rhel_eus:6.0
 before 0:4.8.0-12.el6_0.1
0:4.8.0-12.el6_0.1
rpm-libs
Red Hat:rhel_eus:6.0
 before 0:4.8.0-12.el6_0.1
0:4.8.0-12.el6_0.1
rpm-python
Red Hat:rhel_eus:6.0
 before 0:4.8.0-12.el6_0.1
0:4.8.0-12.el6_0.1
rpm
Red Hat:enterprise_linux:6::server
 before 0:4.8.0-16.el6_1.1
0:4.8.0-16.el6_1.1
rpm-build
Red Hat:enterprise_linux:6::server
 before 0:4.8.0-16.el6_1.1
0:4.8.0-16.el6_1.1
rpm-debuginfo
Red Hat:enterprise_linux:6::server
 before 0:4.8.0-16.el6_1.1
0:4.8.0-16.el6_1.1
rpm-devel
Red Hat:enterprise_linux:6::server
 before 0:4.8.0-16.el6_1.1
0:4.8.0-16.el6_1.1
rpm-libs
Red Hat:enterprise_linux:6::server
 before 0:4.8.0-16.el6_1.1
0:4.8.0-16.el6_1.1
rpm-python
Red Hat:enterprise_linux:6::server
 before 0:4.8.0-16.el6_1.1
0:4.8.0-16.el6_1.1
rpm-apidocs
Red Hat:rhel_eus:6.0
 before 0:4.8.0-12.el6_0.1
0:4.8.0-12.el6_0.1
rpm-cron
Red Hat:rhel_eus:6.0
 before 0:4.8.0-12.el6_0.1
0:4.8.0-12.el6_0.1
rpm-apidocs
Red Hat:enterprise_linux:6::server
 before 0:4.8.0-16.el6_1.1
0:4.8.0-16.el6_1.1
rpm-cron
Red Hat:enterprise_linux:6::server
 before 0:4.8.0-16.el6_1.1
0:4.8.0-16.el6_1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-3378 is a high vulnerability (CVSS 9.3) in Rpm, published December 24, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.92%, the 93rd percentile. Fixed in rpm 4.9.1.2-1.

References

Show 16 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open