Libzypp (Suse) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2026-07-02. Vendor: Suse.

CVEs of Libzypp

• CVE-2026-44941 - CVSS 8.8 (high), 2026-07-02: A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious…
• CVE-2026-25707 - CVSS 8.8 (high), 2026-06-29: A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories…
• CVE-2026-44942 - CVSS 6.5 (medium), 2026-06-18: A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by…
• CVE-2018-7685 - CVSS 7.8 (high), 2018-08-31: The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not…
• CVE-2017-9269 - CVSS 9.8 (critical), 2018-03-01: In libzypp before August 2018 GPG keys attached to YUM repositories were not correctly pinned, allowing malicious repository mirrors to silently downgrade to…
• CVE-2017-7436 - CVSS 8.1 (high), 2018-03-01: In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious…
• CVE-2017-7435 - CVSS 8.1 (high), 2018-03-01: In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious…