Opensuse Libzypp
7 CVEs affecting Opensuse Libzypp. Latest disclosed: 2026-07-02. Critical: 0, High: 6.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-25707 | High | 8.8 | 2026-06-29 | A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories t… |
CVE-2026-44941 | High | 8.4 | 2026-07-02 | A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious reposito… |
CVE-2017-7436 | High | 8.1 | 2018-03-01 | In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious serve… |
CVE-2017-7435 | High | 8.1 | 2018-03-01 | In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious serve… |
CVE-2018-7685 | High | 7.8 | 2018-08-31 | The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not disp… |
CVE-2017-9269 | High | 7.7 | 2018-03-01 | In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to u… |
CVE-2019-18900 | Medium | 4.0 | 2020-01-24 | : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed lo… |