rpm package
opensuse/libsolv&distro=openSUSE Leap 16.0
pkg:rpm/opensuse/libsolv&distro=openSUSE%20Leap%2016.0
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-48863 | Hig | 7.5 | < 0.7.39-160000.1.1 | 0.7.39-160000.1.1 | Jul 16, 2026 | A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI l | |
| CVE-2026-44941 | Hig | 8.4 | < 0.7.39-160000.1.1 | 0.7.39-160000.1.1 | Jul 2, 2026 | A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root. | |
| CVE-2026-25707 | Hig | 8.8 | < 0.7.39-160000.1.1 | 0.7.39-160000.1.1 | Jun 29, 2026 | A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation. | |
| CVE-2026-44942 | Med | 6.5 | < 0.7.39-160000.1.1 | 0.7.39-160000.1.1 | Jun 18, 2026 | A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content. | |
| CVE-2026-9149 | Med | 6.5 | < 0.7.39-160000.1.1 | 0.7.39-160000.1.1 | May 21, 2026 | A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write | |
| CVE-2026-9150 | Med | 6.5 | < 0.7.39-160000.1.1 | 0.7.39-160000.1.1 | May 20, 2026 | A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to me | |
| CVE-2026-44933 | Hig | 7.8 | < 0.7.39-160000.1.1 | 0.7.39-160000.1.1 | May 20, 2026 | `PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`. If the chroot target is `/`, it is a no-op, allowing the traversed path to execute host binaries (like `/bin/b |
- affected < 0.7.39-160000.1.1fixed 0.7.39-160000.1.1
A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI l
- affected < 0.7.39-160000.1.1fixed 0.7.39-160000.1.1
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by attackers able to supply a malicious repository to inject or overwrite files in the target system as root.
- affected < 0.7.39-160000.1.1fixed 0.7.39-160000.1.1
A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by remote attackers supplying repositories to overwrite files on the system, leading to denial of service or privilege escalation.
- affected < 0.7.39-160000.1.1fixed 0.7.39-160000.1.1
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.
- affected < 0.7.39-160000.1.1fixed 0.7.39-160000.1.1
A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write
- affected < 0.7.39-160000.1.1fixed 0.7.39-160000.1.1
A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to me
- affected < 0.7.39-160000.1.1fixed 0.7.39-160000.1.1
`PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`. If the chroot target is `/`, it is a no-op, allowing the traversed path to execute host binaries (like `/bin/b