LI
Product
Libzypp
7
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 1High 5Medium 0Low 1
Watch
Add Libzypp to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-9269 | 9.8 | Mar 1 | In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to unsigned repositories… Affected: All versions, or not specified |
| CVE-2026-44941 | 8.8 | Jul 2 | libzypp path traversal via "keyhint" in repomd.xml Affected: before 17.38.12 |
| CVE-2026-25707 | 8.8 | Jun 29 | Handcrafted repo metadata may cause arbitrary local files to be overwritten by libzypp Affected: before 17.38.10 |
| CVE-2017-7436 | 8.1 | Mar 1 | In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject… Affected: through 16.15.2 |
| CVE-2017-7435 | 8.1 | Mar 1 | In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject… Affected: through 16.15.2 |
| CVE-2018-7685 | 7.8 | Aug 31 | The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted… Affected: before 17.5.0 |
| CVE-2019-18900 | 3.3 | Jan 24 | : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed local attackers to… Affected: before 16.21.2-27.68.1; before 16.21.2-2.45.1; before 17.19.0-3.34.1 |
Showing 7