Every CVE Search/ Get API key

CVE-2010-2059

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not...

7.2 HighFix available

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.

Exploit likelihood

0.40%Down 1.1 points since Feb 4, 2022
90%50%10%1%

What each source reports

NVD Score used 7.2

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.

Record
CVE-2010-2059
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-264
Updated
2026-11-02
CVE List No score

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.

Record
CVE-2010-2059
Updated
2026-11-02
EUVDEUVD-2010-2078 No score

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.

Record
EUVD-2010-2078
Updated
2026-11-03
GitHub AdvisoriesGHSA-f3f6-q22p-8fh5 No score

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not...

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.

Record
GHSA-f3f6-q22p-8fh5
Updated
2026-11-02
OSV No score

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.

Record
CVE-2010-2059
Updated
2026-11-02
OSVDEBIAN-CVE-2010-2059 No score

lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly reset the metadata of an executable file during replacement of the file in an RPM package upgrade, which might allow local users to gain privileges by creating a hard link to a vulnerable (1) setuid or (2) setgid file.

Record
DEBIAN-CVE-2010-2059
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
rpm
Debian:12
 before 4.8.1-1
4.8.1-1
rpm
Debian:13
 before 4.8.1-1
4.8.1-1
rpm
Debian:14
 before 4.8.1-1
4.8.1-1
popt
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:1.9.1-33_nonptl.el4_8.1
0:1.9.1-33_nonptl.el4_8.1
rpm
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-build
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-debuginfo
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-devel
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-libs
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-python
Red Hat:enterprise_linux:4::as
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
Show 39 moreShow less
Affected packages
PackageAffectedFixed
popt
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:1.9.1-33_nonptl.el4_8.1
0:1.9.1-33_nonptl.el4_8.1
rpm
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-build
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-debuginfo
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-devel
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-libs
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-python
Red Hat:enterprise_linux:4::desktop
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
popt
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:1.9.1-33_nonptl.el4_8.1
0:1.9.1-33_nonptl.el4_8.1
rpm
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-build
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-debuginfo
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-devel
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-libs
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-python
Red Hat:enterprise_linux:4::es
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
popt
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:1.9.1-33_nonptl.el4_8.1
0:1.9.1-33_nonptl.el4_8.1
rpm
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-build
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-debuginfo
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-devel
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-libs
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm-python
Red Hat:enterprise_linux:4::ws
From an advisory covering 2 CVEs
 before 0:4.3.3-33_nonptl.el4_8.1
0:4.3.3-33_nonptl.el4_8.1
rpm
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-apidocs
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-build
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-debuginfo
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-devel
Red Hat:enterprise_linux:5::client_workstation
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
popt
Red Hat:enterprise_linux:5::client
 before 0:1.10.2.3-20.el5_5.1
0:1.10.2.3-20.el5_5.1
rpm
Red Hat:enterprise_linux:5::client
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-debuginfo
Red Hat:enterprise_linux:5::client
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-libs
Red Hat:enterprise_linux:5::client
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-python
Red Hat:enterprise_linux:5::client
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
popt
Red Hat:enterprise_linux:5::server
 before 0:1.10.2.3-20.el5_5.1
0:1.10.2.3-20.el5_5.1
rpm
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-apidocs
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-build
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-debuginfo
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-devel
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-libs
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1
rpm-python
Red Hat:enterprise_linux:5::server
 before 0:4.4.2.3-20.el5_5.1
0:4.4.2.3-20.el5_5.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2010-2059 is a high vulnerability (CVSS 7.2) in Rpm, published June 8, 2010. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in rpm 4.8.1-1.

References

Show 29 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open