8.1
Élevée
CVE-2017-7436 In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could…
Description
In libzypp before 20170803 it was possible to retrieve unsigned packages without a warning to the user which could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| libzypp 20170803 | premières → < 20170803 | 20170803 |
Références
- SUSE-SU-2017:2040 lists.opensuse.org
- bugzilla.suse.com bugzilla.suse.com
- www.suse.com www.suse.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de libzypp
Les 7 CVE de libzypp →
CVE-2026-44941
A relative path traversal in the "keyhint" option in repomd.xml parsing of libzypp before 17.38.12 can be used by…
8.4
Élevée
CVE-2026-25707
A relative path traversal bug problem when processing repository metadata in libzypp before 17.38.10 could be used by…
8.8
Élevée
CVE-2026-44942
A path traversal in handling the "path" component of .repo files processed by libzypp before 17.38.13 in the 17.x…
6.5
Moyenne
CVE-2018-7685
The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the…
7.8
Élevée