Approved changes feed: RSS · Atom
cpe:2.3:a:suse:libzypp:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Suse (ec535637-432e-5a38-96dd-4ec1e0138f73) |
|---|---|
| Product | Libzypp (d5daadc6-a9e5-5f23-832c-1e7fa9386834) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44942 |
vulnerable | 2026-07-29 00:52:14.939340 |
libzypp .repo files can have an optional path which can lead to path traversal attacks
MEDIUM (6.5)
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.
Published: 2026-06-18T09:57:12.821Z
Updated: 2026-06-18T12:09:37.292Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44941 |
vulnerable | 2026-07-29 00:52:14.933021 |
libzypp path traversal via "keyhint" in repomd.xml
HIGH (8.4)
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
Published: 2026-07-02T15:19:05.302Z
Updated: 2026-07-07T13:14:20.403Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-25707 |
vulnerable | 2026-07-29 00:34:57.263445 |
Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp
HIGH (8.8)
A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.
Published: 2026-06-29T10:04:59.223Z
Updated: 2026-06-30T03:55:33.471Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2018-7685 |
vulnerable | 2026-06-08 05:12:03.982729 |
libzypp does not reevaluate malicious rpms once downloaded
HIGH (7.8)
The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.
Published: 2018-08-31T15:00:00.000Z
Updated: 2024-09-17T00:52:15.696Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-9269 |
vulnerable | 2026-06-08 05:10:09.547208 |
lack of keypinning in libzypp could lead to repository switching
HIGH (7.7)
In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories with potential malicious content.
Published: 2018-03-01T19:00:00.000Z
Updated: 2024-09-17T00:36:56.264Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7436 |
vulnerable | 2026-06-08 05:09:55.956648 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2017-7435 |
vulnerable | 2026-06-08 05:09:55.955387 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.