CVE-2017-7500
Fixed in a distro release EPSS <1%CVSS 7.3
It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.
Products: rpm
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rpm | no fix |
| Debian 13 | rpm | no fix |
| Debian 14 | rpm | no fix |
| SUSE Enterprise Storage 4 | python3-rpm | 4.11.2-16.21.1 |
| SUSE Enterprise Storage 4 | rpm | 4.11.2-16.21.1 |
| SUSE Enterprise Storage 4 | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | rpm | 4.11.2-16.16.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | rpm-python | 4.11.2-16.16.1 |
| SUSE Linux Enterprise Desktop 12 SP3 | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | python3-rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Desktop 12 SP4 | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | python-rpm | 4.14.1-10.3.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | rpm | 4.14.1-10.3.1 |
| SUSE Linux Enterprise Module for Development Tools 15 | rpm | 4.14.1-10.3.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | python3-rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP1-LTSS | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | python3-rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | python3-rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP3 | python3-rpm | 4.11.2-16.16.1 |
| SUSE Linux Enterprise Server 12 SP3 | python3-rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP3 | rpm | 4.11.2-16.16.1 |
| SUSE Linux Enterprise Server 12 SP3 | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP3 | rpm-python | 4.11.2-16.16.1 |
| SUSE Linux Enterprise Server 12 SP3 | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP4 | python3-rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP4 | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12 SP4 | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12-LTSS | python3-rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12-LTSS | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server 12-LTSS | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | python3-rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP1 | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | python3-rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | python3-rpm | 4.11.2-16.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | python3-rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | rpm | 4.11.2-16.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | rpm-python | 4.11.2-16.16.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | python3-rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | rpm-python | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | rpm | 4.11.2-16.21.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | rpm | 4.11.2-16.16.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | rpm | 4.11.2-16.21.1 |
| SUSE OpenStack Cloud 7 | python3-rpm | 4.11.2-16.21.1 |
| SUSE OpenStack Cloud 7 | rpm | 4.11.2-16.21.1 |
| SUSE OpenStack Cloud 7 | rpm-python | 4.11.2-16.21.1 |
| Ubuntu Pro 14.04 LTS | rpm | no fix |
| Ubuntu Pro 16.04 LTS | rpm | no fix |
| openSUSE Tumbleweed | rpm | 4.16.1.3-3.2 |