PatchTheCVErpath vulnerabilities
Recent CVEs affecting rpath products. 11 tracked.
rpath has 11 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 0. Most recent: 2008-11-17. Highest priority: CVE-2007-5962 (score 59/100).
- CVE-2008-4832 MEDIUM 6.9 DOWNGRADE rc.sysinit in initscripts 8.12-8.21 and 8.56.15-0.1 on rPath allows local users to delete arbitrary files via
- CVE-2008-3139 MEDIUM 5.0 DOWNGRADE DOWNGRADE The RTMPT dissector in Wireshark (formerly Ethereal) 0.99.8 through 1.0.0 allows remote attackers to cause a d
- CVE-2008-3138 MEDIUM 5.0 DOWNGRADE DOWNGRADE The (1) PANA and (2) KISMET dissectors in Wireshark (formerly Ethereal) 0.99.3 through 1.0.0 allow remote atta
- CVE-2008-2140 LOW 2.6 DOWNGRADE Cross-site request forgery (CSRF) vulnerability in the rootpw plugin in rPath Appliance Platform Agent 2 and 3
- CVE-2008-2139 MEDIUM 6.5 MITIGATE The rootpw plugin in rPath Appliance Platform Agent 2 and 3 does not re-validate requests from a browser with
- CVE-2008-1078 HIGH 7.2 MITIGATE MITIGATE expn in the am-utils and net-fs packages for Gentoo, rPath Linux, and other distributions, allows local users
- CVE-2007-5962 HIGH 7.1 MITIGATE MITIGATE Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedor
- CVE-2007-5686 MEDIUM 4.9 MITIGATE initscripts in rPath Linux 1 sets insecure permissions for the /var/log/btmp file, which allows local users to
- CVE-2007-5194 MEDIUM 6.9 DOWNGRADE The Chroot server in rMake 1.0.11 creates a /dev/zero device file with read/write permissions for the rMake us
- CVE-2007-1351 HIGH 8.5 MITIGATE DOWNGRADE Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2)
- CVE-2007-0536 HIGH 7.2 MITIGATE The chroot helper in rMake for rPath Linux 1 does not drop supplemental groups, which causes packages to be in
FAQ
How do I fix rpath vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is rpath being exploited right now?
None of the tracked rpath CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which rpath CVE should I patch first?
CVE-2007-5962 currently ranks highest (59/100): Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedor.