Libzypp (Opensuse) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 933 known versions, newest CVE from 2026-07-02. Vendor: Opensuse.

CVEs of Libzypp

• CVE-2026-44941 - CVSS 8.8 (high), 2026-07-02: A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious…
• CVE-2026-25707 - CVSS 8.8 (high), 2026-06-29: A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories…
• CVE-2019-18900 - CVSS 4 (medium), 2020-01-24: : Incorrect Default Permissions vulnerability in libzypp of SUSE CaaS Platform 3.0, SUSE Linux Enterprise Server 12, SUSE Linux Enterprise Server 15 allowed…
• CVE-2018-7685 - CVSS 7.8 (high), 2018-08-31: The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not…
• CVE-2017-9269 - CVSS 9.8 (critical), 2018-03-01: In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to…
• CVE-2017-7436 - CVSS 8.1 (high), 2018-03-01: In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious…
• CVE-2017-7435 - CVSS 8.1 (high), 2018-03-01: In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious…