CVE-2010-2059: lib/fsm.c in RPM 4.8.0 and unspecified 4.7.x and 4.6.x versions, and RPM before 4.4.3, does not properly re...

Security readout for executives and security teams

This is an old RPM package manager flaw where a package upgrade may leave privileged executable metadata in an unsafe state. A local user could potentially turn that into higher privileges by abusing hard links to setuid or setgid files. It matters mainly on legacy Linux or appliance systems still carrying affected RPM versions. Exposure is most likely on legacy RPM-based systems, old distributions, or products bundling third-party RPM packages, including VMware ESX Service Console updates referenced in VMSA-2011-0004. Modern supported Linux platforms are less likely exposed, but vulnerability managers should verify package lineage rather than assume. Treat as a legacy local privilege-escalation risk. It is not a broad internet-facing emergency based on the supplied evidence, but it should be closed during legacy platform remediation and appliance review, especially where untrusted local users exist. Mitigation focus: Check vendor advisories for affected distributions and appliances.; Update RPM packages using vendor-supported security updates.; Prioritize legacy systems with local shell or multi-user access..

Prepared

Jun 28, 2026, 02:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.