Advisory ROSA-SA-2021-1963

Software: rpm 4.11.3
OS: Cobalt 7.9

CVE-ID: CVE-2017-7501
CVE-Crit: HIGH
CVE-DESC: It was discovered that rpm versions prior to 4.13.0.2 use temporary files with predictable names when installing RPM. An attacker with the ability to write to the directory where the files will be installed could create symbolic links to an arbitrary location and change content and possibly permissions on arbitrary files that could be used for denial of service or possibly privilege escalation.
CVE-STATUS: default
CVE-REV: Default

CVE-ID: CVE-2021-20266
CVE-Crit: MEDIUM
CVE-DESC: A bug was found in hdrblobInit () RPM in lib / header.c. This flaw allows an attacker who can modify rpmdb to cause reads outside the valid range. The biggest threat from this vulnerability is to system availability.
CVE-STATUS: default
CVE-REV: default