RPM before 4.9.1.3 does not properly validate region tags which allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via an invalid region tag in a package header to the (1) headerLoad (2) rpmReadSignature or (3) headerVerify function.