{"id":"CVE-2017-7500","details":"It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.","modified":"2026-07-08T16:53:49.472355Z","published":"2018-08-13T17:29:00.357Z","related":["SUSE-SU-2018:2073-1","SUSE-SU-2018:3286-1","SUSE-SU-2018:3884-1","SUSE-SU-2018:3884-2","openSUSE-SU-2024:11305-1"],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:rpm:rpm:4.14.0.0:rc1:*:*:*:*:*:*","cpe:2.3:a:rpm:rpm:4.14.0.0:rc2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"4.14.0.0-rc1"},{"last_affected":"4.14.0.0-rc1"},{"introduced":"4.14.0.0-rc2"},{"last_affected":"4.14.0.0-rc2"}],"source":"CPE_STRING","vendor_product":"rpm:rpm"}]},"references":[{"type":"ADVISORY","url":"https://github.com/rpm-software-management/rpm/commit/c815822c8bdb138066ff58c624ae83e3a12ebfa9"},{"type":"ADVISORY","url":"https://github.com/rpm-software-management/rpm/commit/f2d3be2a8741234faaa96f5fd05fdfdc75779a79"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7500"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/rpm-software-management/rpm","events":[{"introduced":"0"},{"fixed":"c14fa5e05801481d9b4bbc8bedc6a02527713f12"},{"fixed":"c815822c8bdb138066ff58c624ae83e3a12ebfa9"},{"fixed":"f2d3be2a8741234faaa96f5fd05fdfdc75779a79"}],"database_specific":{"cpe":"cpe:2.3:a:rpm:rpm:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"4.13.0.0"},{"fixed":"4.13.0.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["rpm-4.13.0.1-release","rpm-4.13.0-release","rpm-4.13.0-rc2","rpm-4.13.0-rc1","rpm-4.13.0-alpha","rpm-4.12.0-alpha","rpm-4.11.0-alpha","rpm-4.8.0-beta1","rpm-4.4.2.1-rc2","rpm-4.4.2.1-rc1","rpm-4.4.2-release","rpm-4.4.1-release","rpm-4.4-release"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-7500.json","vanir_signatures_modified":"2026-07-08T16:53:49Z","vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"233530214035563793370843555192189641103","length":4307},"id":"CVE-2017-7500-2910d3ee","signature_type":"Function","signature_version":"v1","source":"https://github.com/rpm-software-management/rpm/commit/c815822c8bdb138066ff58c624ae83e3a12ebfa9","target":{"file":"lib/verify.c","function":"rpmfilesVerify"}},{"digest":{"threshold":0.9,"line_hashes":["239671988295184614856978349487568478067","19450716624506856550250097797469092389","250682327474676124318368018576928341558","111235334660195848448456541765670895264","329795812349938396996022338722829754201","201187616379880976329562329711075448237"]},"id":"CVE-2017-7500-43a12259","signature_type":"Line","signature_version":"v1","source":"https://github.com/rpm-software-management/rpm/commit/c815822c8bdb138066ff58c624ae83e3a12ebfa9","target":{"file":"lib/verify.c"},"deprecated":false},{"id":"CVE-2017-7500-43e41be3","signature_type":"Function","signature_version":"v1","source":"https://github.com/rpm-software-management/rpm/commit/f2d3be2a8741234faaa96f5fd05fdfdc75779a79","target":{"file":"lib/fsm.c","function":"rpmPackageFilesInstall"},"deprecated":false,"digest":{"function_hash":"48067076022380632713499368211808245130","length":3235}},{"signature_version":"v1","source":"https://github.com/rpm-software-management/rpm/commit/f2d3be2a8741234faaa96f5fd05fdfdc75779a79","target":{"file":"lib/fsm.c"},"deprecated":false,"digest":{"line_hashes":["264126973091301003040853053494319189921","298447752790504042642254408681848776755","294692896974570784040787141269428342145","138067321898803316349977720914849998191","158096781839352298848545423017932260947","93269803876808907005176407753494945294","137046692173860993461998873713267951363","137302550875407019462629274778944273964","41347062033662188884304045978624277588","260383492752053098008012928430949396045","244654994588480788169805851042092453307","211461232812925818734804653279391152314","204240354157755644958980960327127388508","302694156893773645515401717223033417921","10471339086552282659663593381957303989","43580384629917002049581188334897998765","332554652458105320167297679298012300484"],"threshold":0.9},"id":"CVE-2017-7500-9f11fe1d","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"312799423906078026915657293693984079195","length":1431},"id":"CVE-2017-7500-bee95872","signature_type":"Function","signature_version":"v1","source":"https://github.com/rpm-software-management/rpm/commit/f2d3be2a8741234faaa96f5fd05fdfdc75779a79","target":{"file":"lib/fsm.c","function":"fsmVerify"}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}