CVE-2017-7501
High
Description
It was found that versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with ability to write in a directory where files will be installed could create symbolic links to an arbitrary location and modify content, and possibly permissions to arbitrary files, which could be used for denial of service or possibly privilege escalation.
SeverityHigh
CVSS7.8
Exploit probability—
ProductRpm
PublishedNov 22, 2017
First seenNov 22, 2017
Weakness typeCWE-59Improper link resolution
How to fix
Update
- rpm rpm4.13.0.3 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rpm rpm | v < 4.13.0.3 | 4.13.0.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.