rpm package
suse/zypper&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7
pkg:rpm/suse/zypper&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Basesystem%2015%20SP7
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-48863 | Hig | 7.5 | < 1.14.98-150700.13.6.1 | 1.14.98-150700.13.6.1 | Jul 16, 2026 | A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI l | |
| CVE-2026-44942 | Med | 6.5 | < 1.14.98-150700.13.6.1 | 1.14.98-150700.13.6.1 | Jun 18, 2026 | A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content. | |
| CVE-2026-9149 | Med | 6.5 | < 1.14.98-150700.13.6.1 | 1.14.98-150700.13.6.1 | May 21, 2026 | A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write | |
| CVE-2026-9150 | Med | 6.5 | < 1.14.98-150700.13.6.1 | 1.14.98-150700.13.6.1 | May 20, 2026 | A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to me | |
| CVE-2026-44933 | Hig | 7.8 | < 1.14.98-150700.13.6.1 | 1.14.98-150700.13.6.1 | May 20, 2026 | `PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`. If the chroot target is `/`, it is a no-op, allowing the traversed path to execute host binaries (like `/bin/b |
- affected < 1.14.98-150700.13.6.1fixed 1.14.98-150700.13.6.1
A flaw was found in libsolv. A stack-based buffer overflow vulnerability exists in the PGP verification component due to incorrect length handling when copying EdDSA 's' MPI into a stack buffer. A remote attacker could craft a malicious Ed25519 PGP signature with mismatched MPI l
- affected < 1.14.98-150700.13.6.1fixed 1.14.98-150700.13.6.1
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x series, or before 16.22.19 could be used by attackers to fill directories on the system outside of the zypp cache with content.
- affected < 1.14.98-150700.13.6.1fixed 1.14.98-150700.13.6.1
A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write
- affected < 1.14.98-150700.13.6.1fixed 1.14.98-150700.13.6.1
A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to me
- affected < 1.14.98-150700.13.6.1fixed 1.14.98-150700.13.6.1
`PluginScript` attempts to `chroot` the plugin to the `repoManagerRoot`, this root is frequently `/` (the system root) in standard configurations or when using `--root`. If the chroot target is `/`, it is a no-op, allowing the traversed path to execute host binaries (like `/bin/b