Tao Pan

**Name of the Vulnerable Software and Affected Versions** rpm (affected versions not specified) **Description** A heap-based buffer overflow occurs when parsing a symlink entry in an untrusted RPM package. If the `RPMTAG LONGFILESIZES` value is set to 0xFFFFFFFFFFFFFFFF, an integer overflow occurs in the `iterReadArchiveNext()` function, reducing a buffer allocation to one byte. Subsequently, the `cpio` filesize field is used to write data beyond the allocated buffer. This issue can be triggered using `rpm2cpio`, `rpm2archive`, or the `rpm -qlvp` command on an untrusted package. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.