CVE-2017-7501

It was found that versions of rpm before 4.13.0.2 use temporary files with
predictable names when installing an RPM. An attacker with ability to write
in a directory where files will be installed could create symbolic links to
an arbitrary location and modify content, and possibly permissions to
arbitrary files, which could be used for denial of service or possibly
privilege escalation.