CVE catalog
CVE-2017-7501
rpm: CVE-2017-7501
- Severity
- High · CVSS 7.3
CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.39% · Oct 25, 2026
It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rpm | sid | 6.1.0-1 | vulnerable |
| Debian | rpm | forky | 6.1.0-1 | vulnerable |
| Debian | rpm | trixie | 4.20.1+dfsg-3 | vulnerable |
| Debian | rpm | bookworm | 4.18.0+dfsg-1+deb12u1 | vulnerable |
| Ubuntu | rpm | pro | 4.12.0.1+dfsg1-3build2 | vulnerable |
| Ubuntu | rpm | pro | 4.12.0.1+dfsg1-3build3 | vulnerable |
| Ubuntu | rpm | pro | 4.12.0.1+dfsg1-3ubuntu0.1~esm1 | vulnerable |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rpm | source | sid | (unfixed) | unimportant | Not reported | Not reported |
| Debian | rpm | source | forky | (unfixed) | unimportant | Not reported | Not reported |
| Debian | rpm | source | trixie | (unfixed) | unimportant | Not reported | Not reported |
| Debian | rpm | source | bookworm | (unfixed) | unimportant | Not reported | Not reported |
OpenFactory catalog packages
[Debian 12 (Bookworm)]
- [librpm9]Affected
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [librpmbuild9]Affected
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [librpm-dev]Affected
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [librpmio9]Affected
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [librpmsign9]Affected
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [python3-rpm]Affected
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [rpm]Affected
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [rpm2cpio]Affected
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [rpm-common]Affected
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· amd64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· arm64 · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
- [rpm-i18n]Affected
Source package: [rpm]
Details (2)
4.18.0+dfsg-1+deb12u1· all · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
4.18.0+dfsg-1+deb12u1· all · bookwormAffected
dsa · rpm · debian · bookworm; dsa · rpm · debian · 12
[Debian 13 (Trixie)]
- [librpm10]Affected
Source package: [rpm]
Details (2)
4.20.1+dfsg-3· amd64 · trixieAffected
dsa · rpm · debian · 13
4.20.1+dfsg-3· arm64 · trixieAffected
dsa · rpm · debian · 13
- [librpmbuild10]Affected
Source package: [rpm]
Details (2)
4.20.1+dfsg-3· amd64 · trixieAffected
dsa · rpm · debian · 13
4.20.1+dfsg-3· arm64 · trixieAffected
dsa · rpm · debian · 13
- [librpm-dev]Affected
Source package: [rpm]
Details (2)
4.20.1+dfsg-3· amd64 · trixieAffected
dsa · rpm · debian · 13
4.20.1+dfsg-3· arm64 · trixieAffected
dsa · rpm · debian · 13
- [librpmio10]Affected
Source package: [rpm]
Details (2)
4.20.1+dfsg-3· amd64 · trixieAffected
dsa · rpm · debian · 13
4.20.1+dfsg-3· arm64 · trixieAffected
dsa · rpm · debian · 13
- [librpmsign10]Affected
Source package: [rpm]
Details (2)
4.20.1+dfsg-3· amd64 · trixieAffected
dsa · rpm · debian · 13
4.20.1+dfsg-3· arm64 · trixieAffected
dsa · rpm · debian · 13
- [python3-rpm]Affected
Source package: [rpm]
Details (2)
4.20.1+dfsg-3· amd64 · trixieAffected
dsa · rpm · debian · 13
4.20.1+dfsg-3· arm64 · trixieAffected
dsa · rpm · debian · 13
- [rpm]Affected
Details (2)
4.20.1+dfsg-3· amd64 · trixieAffected
dsa · rpm · debian · 13
4.20.1+dfsg-3· arm64 · trixieAffected
dsa · rpm · debian · 13
- [rpm2cpio]Affected
Source package: [rpm]
Details (2)
4.20.1+dfsg-3· amd64 · trixieAffected
dsa · rpm · debian · 13
4.20.1+dfsg-3· arm64 · trixieAffected
dsa · rpm · debian · 13
- [rpm-common]Affected
Source package: [rpm]
Details (2)
4.20.1+dfsg-3· amd64 · trixieAffected
dsa · rpm · debian · 13
4.20.1+dfsg-3· arm64 · trixieAffected
dsa · rpm · debian · 13
- [rpm-i18n]Affected
Source package: [rpm]
Details (2)
4.20.1+dfsg-3· all · trixieAffected
dsa · rpm · debian · 13
4.20.1+dfsg-3· all · trixieAffected
dsa · rpm · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2018_3286-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2017-7501]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2017-7501]
- [https://security-tracker.debian.org/tracker/CVE-2017-7501]
- [https://security.access.redhat.com/data/csaf/v2/vex/2017/cve-2017-7501.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2017/wid-sec-w-2024-0876.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]