RHBA-2011:1737 - Bug Fix Advisory

Topic

Updated rpm packages that fix several bugs and add one enhancement are now
available for Red Hat Enterprise Linux 6.

Description

The RPM Package Manager (RPM) is a powerful command line driven package
management system that can install, uninstall, verify, query and update software
packages.

This update fixes the following bugs:

• Prior to this update, RPM did not allow for self-conflicts. As a result, a

package could not be installed if a conflict was added against the name of this
package. With this update self-conflicts are permitted. Now, packages can be
installed as expected. (BZ#651951)

• The rpm2cpio.sh utility was omitted when RPM switched the default compression

format for the package payload to xz. As a consequence, the utility was not able
to extract files. This update adds the xz support for rpm2cpio.sh and the
utility now extracts files successfully. (BZ#674348)

• Prior to this update, when installing a package containing the same files as

an already installed package, the file with the less preferred architecture was
overwritten silently even if the file was not a binary. With this update, only
binary files can overwrite other binary files; conflicting non-identical and
non-binary files print an error message. (BZ#705115)

• Previously, files, that were listed in the spec file with the %defattr(-)

directive, did not keep the attributes they had in the build root. With this
update, the modified RPM can now keep these attributes. (BZ#705993)

• Prior to this update, signing packages that had already been signed with the

same key could cause the entire signing process to abort. With this update, RPM
is modified so that packages with identical signatures are skipped and the
others are signed. (BZ#707449)

• Prior to this update, passing packages with a broken signature could cause the

librpm library to crash. The source code has been revised and broken signatures
are now rejected. (BZ#721363)

This update also adds the following enhancement:

• Previously, importing GPG keys that had already been imported before could

cause RPM to fail with an error message. RPM has been modified and now imports
the keys successfully. (BZ#680889)

All users of RPM are advised to upgrade to these updated packages, which fix
these bugs and add this enhancement.

Solution

Before applying this update, make sure that all previously-released errata
relevant to your system have been applied.

This update is available via Red Hat Network. Details on how to use the Red Hat
Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 674348 - rpm2cpio.sh isn't able to extract files from rhel6 rpms (payload format change) ; FC12-FC15 too
• BZ - 705115 - rpm does not detect file conflict
• BZ - 707449 - Package (re)signing aborts on identical signature
• BZ - 721363 - librpm crashes on query with invalid read
• BZ - 742499 - Segmentation fault for fuzzed rpm

CVEs

(none)

References

(none)