7.8
High
CVE-2018-7685 The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the…
Description
The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| libzypp 17.5 | earliest → < 17.5.0 | 17.5.0 |
References
- bugzilla.suse.com bugzilla.suse.com
- www.suse.com www.suse.com
- lists.suse.com lists.suse.com
Timeline
- Published
- Last modified
Other CVEs of libzypp
The 7 CVEs of libzypp →
CVE-2026-44941
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by…
8.4
High
CVE-2026-25707
A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by…
8.8
High
CVE-2026-44942
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x…
6.5
Medium
CVE-2017-7435
In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could…
8.1
High