QID 671076

The rpm package manager (rpm) is a powerful command line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages.
Each software package consists of an archive of files along with information about the package like its version, a description, etc.
Security fix(es): it was found that rpm did not properly handle rpm installations when a destination path was a symbolic link to a directory, possibly changing ownership and permissions of an arbitrary directory, and rpm files being placed in an arbitrary destination.
An attacker, with write access to a directory in which a subdirectory will be installed, could redirect that directory to an arbitrary location and gain root privilege.(cve-2017-7500)

Note: The preceding description block is extracted directly from the security advisory. Using automation, we have attempted to clean and format it as much as possible without introducing additional issues.

An arbitrary attacker may exploit this vulnerability to compromise the system.