Approved changes feed: RSS · Atom
cpe:2.3:a:rpm:rpm:4.14.0.0:rc2:*:*:*:*:*:*
part: a version: 4.14.0.0 update: rc2
| Vendor | Rpm (c01bad82-b6fe-5fb6-8e3f-74052dbedf9d) |
|---|---|
| Product | Rpm (bbede3a4-0f4c-5ee3-924b-b067fd84e0a2) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:deb/debian/rpm |
purl2cpe | 2026-06-01 10:18:00.521103 |
pkg:deb/ubuntu/rpm |
purl2cpe | 2026-06-01 10:18:00.521105 |
pkg:github/rpm-software-management/rpm |
purl2cpe | 2026-06-01 10:18:00.521106 |
pkg:gitlab/redhat/rpm |
purl2cpe | 2026-06-01 10:18:00.521108 |
pkg:rpm/rpm |
purl2cpe | 2026-06-01 10:18:00.521109 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2017-7500 |
vulnerable | 2026-06-08 05:09:56.218426 |
Details available
HIGH (7.3)
It was found that rpm did not properly handle RPM installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and RPM files being placed in an arbitrary destination. An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.
Published: 2018-08-13T17:00:00.000Z
Updated: 2024-08-05T16:04:11.858Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.