CVE catalog

CVE-2017-7500

rpm: CVE-2017-7500

[CVE catalog]

Severity
High · CVSS 7.3CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.41% · Oct 25, 2026

It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianrpmsid6.1.0-1vulnerable
Debianrpmforky6.1.0-1vulnerable
Debianrpmtrixie4.20.1+dfsg-3vulnerable
Debianrpmbookworm4.18.0+dfsg-1+deb12u1vulnerable
Ubunturpmpro4.12.0.1+dfsg1-3build2vulnerable
Ubunturpmpro4.12.0.1+dfsg1-3build3vulnerable
Ubunturpmpro4.12.0.1+dfsg1-3ubuntu0.1~esm1vulnerable
Opensuserpmtumbleweed4.16.1.3-3.2fixed
Susepython3-rpmopenstack cloud 74.11.2-16.21.1fixed
Suserpmopenstack cloud 74.11.2-16.21.1fixed
Suserpm-pythonopenstack cloud 74.11.2-16.21.1fixed
Suserpmlinux enterprise desktop 12 sp34.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise desktop 12 sp34.11.2-16.21.1fixed
Susepython3-rpmlinux enterprise desktop 12 sp44.11.2-16.21.1fixed
Suserpmlinux enterprise desktop 12 sp44.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise desktop 12 sp44.11.2-16.21.1fixed
Susepython3-rpmlinux enterprise server for sap applications 12 sp24.11.2-16.21.1fixed
Suserpmlinux enterprise server for sap applications 12 sp24.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise server for sap applications 12 sp24.11.2-16.21.1fixed
Suserpmlinux enterprise software development kit 12 sp34.11.2-16.21.1fixed
Suserpmlinux enterprise software development kit 12 sp44.11.2-16.21.1fixed
Susepython3-rpmlinux enterprise server 12-ltss4.11.2-16.21.1fixed
Suserpmlinux enterprise server 12-ltss4.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise server 12-ltss4.11.2-16.21.1fixed
Susepython3-rpmlinux enterprise server 12 sp1-ltss4.11.2-16.21.1fixed
Suserpmlinux enterprise server 12 sp1-ltss4.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise server 12 sp1-ltss4.11.2-16.21.1fixed
Susepython3-rpmlinux enterprise server 12 sp2-ltss4.11.2-16.21.1fixed
Suserpmlinux enterprise server 12 sp2-ltss4.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise server 12 sp2-ltss4.11.2-16.21.1fixed
Susepython3-rpmlinux enterprise server 12 sp2-bcl4.11.2-16.21.1fixed
Suserpmlinux enterprise server 12 sp2-bcl4.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise server 12 sp2-bcl4.11.2-16.21.1fixed
Susepython3-rpmlinux enterprise server 12 sp34.11.2-16.21.1fixed
Suserpmlinux enterprise server 12 sp34.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise server 12 sp34.11.2-16.21.1fixed
Susepython3-rpmlinux enterprise server for sap applications 12 sp34.11.2-16.21.1fixed
Suserpmlinux enterprise server for sap applications 12 sp34.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise server for sap applications 12 sp34.11.2-16.21.1fixed
Susepython3-rpmlinux enterprise server 12 sp44.11.2-16.21.1fixed
Suserpmlinux enterprise server 12 sp44.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise server 12 sp44.11.2-16.21.1fixed
Susepython3-rpmlinux enterprise server for sap applications 12 sp44.11.2-16.21.1fixed
Suserpmlinux enterprise server for sap applications 12 sp44.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise server for sap applications 12 sp44.11.2-16.21.1fixed
Susepython3-rpmenterprise storage 44.11.2-16.21.1fixed
Suserpmenterprise storage 44.11.2-16.21.1fixed
Suserpm-pythonenterprise storage 44.11.2-16.21.1fixed
Susepython3-rpmlinux enterprise server for sap applications 12 sp14.11.2-16.21.1fixed
Suserpmlinux enterprise server for sap applications 12 sp14.11.2-16.21.1fixed
Suserpm-pythonlinux enterprise server for sap applications 12 sp14.11.2-16.21.1fixed
Suserpmlinux enterprise desktop 12 sp34.11.2-16.16.1fixed
Suserpm-pythonlinux enterprise desktop 12 sp34.11.2-16.16.1fixed
Suserpmlinux enterprise software development kit 12 sp34.11.2-16.16.1fixed
Susepython3-rpmlinux enterprise server 12 sp34.11.2-16.16.1fixed
Suserpmlinux enterprise server 12 sp34.11.2-16.16.1fixed
Suserpm-pythonlinux enterprise server 12 sp34.11.2-16.16.1fixed
Susepython3-rpmlinux enterprise server for sap applications 12 sp34.11.2-16.16.1fixed
Suserpmlinux enterprise server for sap applications 12 sp34.11.2-16.16.1fixed
Suserpm-pythonlinux enterprise server for sap applications 12 sp34.11.2-16.16.1fixed
Susepython-rpmlinux enterprise module for basesystem 154.14.1-10.3.1fixed
Suserpmlinux enterprise module for basesystem 154.14.1-10.3.1fixed
Suserpmlinux enterprise module for development tools 154.14.1-10.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianrpmsourcesid(unfixed)unimportantNot reportedNot reported
Debianrpmsourceforky(unfixed)unimportantNot reportedNot reported
Debianrpmsourcetrixie(unfixed)unimportantNot reportedNot reported
Debianrpmsourcebookworm(unfixed)unimportantNot reportedNot reported
Opensuserpmrpmtumbleweed4.16.1.3-3.2Not reportedOPENSUSE-SU-2024:11305-1Not reported
Susepython3-rpmrpmopenstack cloud 74.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmopenstack cloud 74.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmopenstack cloud 74.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise desktop 12 sp34.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmlinux enterprise desktop 12 sp34.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmlinux enterprise desktop 12 sp44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise desktop 12 sp44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmlinux enterprise desktop 12 sp44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmlinux enterprise server for sap applications 12 sp24.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise server for sap applications 12 sp24.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmlinux enterprise server for sap applications 12 sp24.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise software development kit 12 sp34.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise software development kit 12 sp44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmlinux enterprise server 12-ltss4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise server 12-ltss4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmlinux enterprise server 12-ltss4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmlinux enterprise server 12 sp1-ltss4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise server 12 sp1-ltss4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmlinux enterprise server 12 sp1-ltss4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmlinux enterprise server 12 sp2-ltss4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise server 12 sp2-ltss4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmlinux enterprise server 12 sp2-ltss4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmlinux enterprise server 12 sp2-bcl4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise server 12 sp2-bcl4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmlinux enterprise server 12 sp2-bcl4.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmlinux enterprise server 12 sp34.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise server 12 sp34.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmlinux enterprise server 12 sp34.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmlinux enterprise server for sap applications 12 sp34.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise server for sap applications 12 sp34.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmlinux enterprise server for sap applications 12 sp34.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmlinux enterprise server 12 sp44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise server 12 sp44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmlinux enterprise server 12 sp44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmlinux enterprise server for sap applications 12 sp44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmlinux enterprise server for sap applications 12 sp44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmlinux enterprise server for sap applications 12 sp44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmenterprise storage 44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpmrpmenterprise storage 44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Suserpm-pythonrpmenterprise storage 44.11.2-16.21.1Not reportedSUSE-SU-2018:3884-1Not reported
Susepython3-rpmrpmlinux enterprise server for sap applications 12 sp14.11.2-16.21.1Not reportedSUSE-SU-2018:3884-2Not reported
Suserpmrpmlinux enterprise server for sap applications 12 sp14.11.2-16.21.1Not reportedSUSE-SU-2018:3884-2Not reported
Suserpm-pythonrpmlinux enterprise server for sap applications 12 sp14.11.2-16.21.1Not reportedSUSE-SU-2018:3884-2Not reported
Suserpmrpmlinux enterprise desktop 12 sp34.11.2-16.16.1Not reportedSUSE-SU-2018:3286-1Not reported
Suserpm-pythonrpmlinux enterprise desktop 12 sp34.11.2-16.16.1Not reportedSUSE-SU-2018:3286-1Not reported
Suserpmrpmlinux enterprise software development kit 12 sp34.11.2-16.16.1Not reportedSUSE-SU-2018:3286-1Not reported
Susepython3-rpmrpmlinux enterprise server 12 sp34.11.2-16.16.1Not reportedSUSE-SU-2018:3286-1Not reported
Suserpmrpmlinux enterprise server 12 sp34.11.2-16.16.1Not reportedSUSE-SU-2018:3286-1Not reported
Suserpm-pythonrpmlinux enterprise server 12 sp34.11.2-16.16.1Not reportedSUSE-SU-2018:3286-1Not reported
Susepython3-rpmrpmlinux enterprise server for sap applications 12 sp34.11.2-16.16.1Not reportedSUSE-SU-2018:3286-1Not reported
Suserpmrpmlinux enterprise server for sap applications 12 sp34.11.2-16.16.1Not reportedSUSE-SU-2018:3286-1Not reported
Suserpm-pythonrpmlinux enterprise server for sap applications 12 sp34.11.2-16.16.1Not reportedSUSE-SU-2018:3286-1Not reported
Susepython-rpmrpmlinux enterprise module for basesystem 154.14.1-10.3.1Not reportedSUSE-SU-2018:2073-1Not reported
Suserpmrpmlinux enterprise module for basesystem 154.14.1-10.3.1Not reportedSUSE-SU-2018:2073-1Not reported
Suserpmrpmlinux enterprise module for development tools 154.14.1-10.3.1Not reportedSUSE-SU-2018:2073-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [librpm9]Affected

    Source package: [rpm]

    Details (2)
    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [librpmbuild9]Affected

    Source package: [rpm]

    Details (2)
    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [librpm-dev]Affected

    Source package: [rpm]

    Details (2)
    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [librpmio9]Affected

    Source package: [rpm]

    Details (2)
    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [librpmsign9]Affected

    Source package: [rpm]

    Details (2)
    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [python3-rpm]Affected

    Source package: [rpm]

    Details (2)
    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [rpm]Affected
    Details (2)
    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [rpm2cpio]Affected

    Source package: [rpm]

    Details (2)
    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [rpm-common]Affected

    Source package: [rpm]

    Details (2)
    • 4.18.0+dfsg-1+deb12u1 · amd64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · arm64 · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

  • [rpm-i18n]Affected

    Source package: [rpm]

    Details (2)
    • 4.18.0+dfsg-1+deb12u1 · all · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

    • 4.18.0+dfsg-1+deb12u1 · all · bookworm

      Affected

      dsa · rpm · debian · bookworm; dsa · rpm · debian · 12

[Debian 13 (Trixie)]

  • [librpm10]Affected

    Source package: [rpm]

    Details (2)
    • 4.20.1+dfsg-3 · amd64 · trixie

      Affected

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Affected

      dsa · rpm · debian · 13

  • [librpmbuild10]Affected

    Source package: [rpm]

    Details (2)
    • 4.20.1+dfsg-3 · amd64 · trixie

      Affected

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Affected

      dsa · rpm · debian · 13

  • [librpm-dev]Affected

    Source package: [rpm]

    Details (2)
    • 4.20.1+dfsg-3 · amd64 · trixie

      Affected

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Affected

      dsa · rpm · debian · 13

  • [librpmio10]Affected

    Source package: [rpm]

    Details (2)
    • 4.20.1+dfsg-3 · amd64 · trixie

      Affected

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Affected

      dsa · rpm · debian · 13

  • [librpmsign10]Affected

    Source package: [rpm]

    Details (2)
    • 4.20.1+dfsg-3 · amd64 · trixie

      Affected

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Affected

      dsa · rpm · debian · 13

  • [python3-rpm]Affected

    Source package: [rpm]

    Details (2)
    • 4.20.1+dfsg-3 · amd64 · trixie

      Affected

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Affected

      dsa · rpm · debian · 13

  • [rpm]Affected
    Details (2)
    • 4.20.1+dfsg-3 · amd64 · trixie

      Affected

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Affected

      dsa · rpm · debian · 13

  • [rpm2cpio]Affected

    Source package: [rpm]

    Details (2)
    • 4.20.1+dfsg-3 · amd64 · trixie

      Affected

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Affected

      dsa · rpm · debian · 13

  • [rpm-common]Affected

    Source package: [rpm]

    Details (2)
    • 4.20.1+dfsg-3 · amd64 · trixie

      Affected

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · arm64 · trixie

      Affected

      dsa · rpm · debian · 13

  • [rpm-i18n]Affected

    Source package: [rpm]

    Details (2)
    • 4.20.1+dfsg-3 · all · trixie

      Affected

      dsa · rpm · debian · 13

    • 4.20.1+dfsg-3 · all · trixie

      Affected

      dsa · rpm · debian · 13

Next results

Observed:

References