{"schemaVersion":3,"id":"SUSE-RU-2019:2742-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Recommended update for libzypp, zypper, libsolv and PackageKit\n\nThis update for libzypp, zypper, libsolv and PackageKit fixes the following issues:\n\nSecurity issues fixed in libsolv:\n\n- CVE-2018-20532: Fixed NULL pointer dereference at ext/testcase.c (function testcase_read) (bsc#1120629).\n- CVE-2018-20533: Fixed NULL pointer dereference at ext/testcase.c (function testcase_str2dep_complex) in libsolvext.a (bsc#1120630).\n- CVE-2018-20534: Fixed illegal address access at src/pool.h (function pool_whatprovides) in libsolv.a (bsc#1120631).\n\nOther issues addressed in libsolv:\n\n- Fixed an issue where libsolv failed to build against swig 4.0 by updating the version to 0.7.5 (bsc#1135749).\n- Fixed an issue with the package name (bsc#1131823).\n- repo_add_rpmdb: do not copy bad solvables from the old solv file\n- Fixed an issue with  cleandeps updates in which all packages were not updated\n- Experimental DISTTYPE_CONDA and REL_CONDA support\n- Fixed cleandeps jobs when using patterns (bsc#1137977)\n- Fixed favorq leaking between solver runs if the solver is reused\n- Fixed SOLVER_FLAG_FOCUS_BEST updateing packages without reason\n- Be more correct with multiversion packages that obsolete their own name (bnc#1127155)\n- Fix repository priority handling for multiversion packages\n- Make code compatible with swig 4.0, remove obj0 instances\n- repo2solv: support zchunk compressed data\n- Remove NO_BRP_STRIP_DEBUG=true as brp-15-strip-debug will\n  not strip debug info for archives\n\nIssues fixed in libzypp:\n\n- Fix empty metalink downloads if filesize is unknown (bsc#1153557)\n- Recognize riscv64 as architecture\n- Fix installation of new header file (fixes #185)\n- zypp.conf: Introduce `solver.focus` to define the resolvers general\n  attitude when resolving jobs. (bsc#1146415)\n- New container detection algorithm for zypper ps (bsc#1146947)\n- Fix leaking filedescriptors in MediaCurl. (bsc#1116995)\n- Run file conflict check on dry-run. (bsc#1140039)\n- Do not remove orphan products if the .prod file is owned by\n  a package. (bsc#1139795)\n- Rephrase file conflict check summary. (bsc#1140039)\n- Fix bash completions option detection. (bsc#1049825)\n- Fixes a bug where zypper exited on SIGPIPE when downloading packages (bsc#1145521)\n- Fixes an issue where zypper exited with a segmentation fault when updating via YaST2 (bsc#1146027)\n- PublicKey::algoName: supply key algorithm and length\n\nIssues fixed in zypper:\n\n- Update to version 1.14.30\n- Ignore SIGPIPE while STDOUT/STDERR are OK (bsc#1145521)\n- Dump stacktrace on SIGPIPE (bsc#1145521)\n- info: The requested info must be shown in QUIET mode (fixes #287)\n- Fix local/remote url classification.\n- Rephrase file conflict check summary (bsc#1140039)\n- Fix bash completions option detection (bsc#1049825)\n- man: split '--with[out]' like options to ease searching.\n- Unhided 'ps' command in help\n- Added option to show more conflict information\n- Rephrased `zypper ps` hint (bsc#859480)\n- Fixed repo refresh not returning 106-ZYPPER_EXIT_INF_REPOS_SKIPPED\n  if --root is used (bsc#1134226)\n- Fixed unknown package handling in zypper install (bsc#1127608)\n- Re-show progress bar after pressing retry upon install error (bsc#1131113)\n\n\nIssues fixed in PackageKit:\n\n- Port the cron configuration variables to the systemd timer script, and add -sendwait\n  parameter to mail in the script(bsc#1130306).","dates":{"published":"2019-10-22T13:40:42.000Z","modified":"2026-02-04T03:51:21.305Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"libsolv&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","name":"libsolv","label":"libsolv&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libsolv&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","purlType":"rpm","versions":[{"text":"< 0.7.6-3.7.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.6-3.7.2","eol":null,"hubHref":null},{"vendor":"suse","product":"libsolv&distro=SUSE Linux Enterprise Module for Development Tools 15 SP1","name":"libsolv","label":"libsolv&distro=SUSE Linux Enterprise Module for Development Tools 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libsolv&distro=SUSE Linux Enterprise Module for Development Tools 15 SP1","purlType":"rpm","versions":[{"text":"< 0.7.6-3.7.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.6-3.7.2","eol":null,"hubHref":null},{"vendor":"suse","product":"libsolv&distro=SUSE Linux Enterprise Module for Package Hub 15 SP1","name":"libsolv","label":"libsolv&distro=SUSE Linux Enterprise Module for Package Hub 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libsolv&distro=SUSE Linux Enterprise Module for Package Hub 15 SP1","purlType":"rpm","versions":[{"text":"< 0.7.6-3.7.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.6-3.7.2","eol":null,"hubHref":null},{"vendor":"suse","product":"libyui-ncurses-pkg-doc&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","name":"libyui-ncurses-pkg-doc","label":"libyui-ncurses-pkg-doc&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libyui-ncurses-pkg-doc&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","purlType":"rpm","versions":[{"text":"< 2.48.9-7.3.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.48.9-7.3.3","eol":null,"hubHref":null},{"vendor":"suse","product":"libyui-ncurses-pkg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","name":"libyui-ncurses-pkg","label":"libyui-ncurses-pkg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libyui-ncurses-pkg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","purlType":"rpm","versions":[{"text":"< 2.48.9-7.3.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.48.9-7.3.5","eol":null,"hubHref":null},{"vendor":"suse","product":"libyui-qt-pkg-doc&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","name":"libyui-qt-pkg-doc","label":"libyui-qt-pkg-doc&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libyui-qt-pkg-doc&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","purlType":"rpm","versions":[{"text":"< 2.45.27-3.3.3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.45.27-3.3.3","eol":null,"hubHref":null},{"vendor":"suse","product":"libyui-qt-pkg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","name":"libyui-qt-pkg","label":"libyui-qt-pkg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libyui-qt-pkg&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","purlType":"rpm","versions":[{"text":"< 2.45.27-3.3.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.45.27-3.3.5","eol":null,"hubHref":null},{"vendor":"suse","product":"libyui-qt-pkg&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","name":"libyui-qt-pkg","label":"libyui-qt-pkg&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libyui-qt-pkg&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","purlType":"rpm","versions":[{"text":"< 2.45.27-3.3.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.45.27-3.3.5","eol":null,"hubHref":null},{"vendor":"suse","product":"libzypp&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","name":"libzypp","label":"libzypp&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libzypp&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","purlType":"rpm","versions":[{"text":"< 17.15.0-3.9.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.15.0-3.9.1","eol":null,"hubHref":null},{"vendor":"suse","product":"PackageKit&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","name":"PackageKit","label":"PackageKit&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/PackageKit&distro=SUSE Linux Enterprise Module for Desktop Applications 15 SP1","purlType":"rpm","versions":[{"text":"< 1.1.10-12.3.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.10-12.3.5","eol":null,"hubHref":null},{"vendor":"suse","product":"PackageKit&distro=SUSE Linux Enterprise Workstation Extension 15 SP1","name":"PackageKit","label":"PackageKit&distro=SUSE Linux Enterprise Workstation Extension 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/PackageKit&distro=SUSE Linux Enterprise Workstation Extension 15 SP1","purlType":"rpm","versions":[{"text":"< 1.1.10-12.3.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.10-12.3.5","eol":null,"hubHref":null},{"vendor":"suse","product":"yast2-pkg-bindings&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","name":"yast2-pkg-bindings","label":"yast2-pkg-bindings&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/yast2-pkg-bindings&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","purlType":"rpm","versions":[{"text":"< 4.1.2-3.3.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.1.2-3.3.5","eol":null,"hubHref":null},{"vendor":"suse","product":"zypper&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","name":"zypper","label":"zypper&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/zypper&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1","purlType":"rpm","versions":[{"text":"< 1.14.30-3.7.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.14.30-3.7.2","eol":null,"hubHref":null}],"affectedCount":13,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/-2019-2742/suse-ru-20192742-1/","label":"www.suse.com/support/update/announcement/-2019-2742/suse-ru-20192742-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1049825","label":"bugzilla.suse.com/1049825","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1116995","label":"bugzilla.suse.com/1116995","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1120629","label":"bugzilla.suse.com/1120629","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1120630","label":"bugzilla.suse.com/1120630","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1120631","label":"bugzilla.suse.com/1120631","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1127155","label":"bugzilla.suse.com/1127155","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1127608","label":"bugzilla.suse.com/1127608","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1130306","label":"bugzilla.suse.com/1130306","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1131113","label":"bugzilla.suse.com/1131113","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1131823","label":"bugzilla.suse.com/1131823","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1134226","label":"bugzilla.suse.com/1134226","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1135749","label":"bugzilla.suse.com/1135749","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1137977","label":"bugzilla.suse.com/1137977","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1139795","label":"bugzilla.suse.com/1139795","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1140039","label":"bugzilla.suse.com/1140039","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1145521","label":"bugzilla.suse.com/1145521","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1146027","label":"bugzilla.suse.com/1146027","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1146415","label":"bugzilla.suse.com/1146415","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1146947","label":"bugzilla.suse.com/1146947","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1153557","label":"bugzilla.suse.com/1153557","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/859480","label":"bugzilla.suse.com/859480","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20532","label":"www.suse.com/security/cve/CVE-2018-20532","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20533","label":"www.suse.com/security/cve/CVE-2018-20533","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20534","label":"www.suse.com/security/cve/CVE-2018-20534","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2018-20532","CVE-2018-20533","CVE-2018-20534"],"downstream":[],"duplicates":[],"related":["CVE-2018-20532","CVE-2018-20533","CVE-2018-20534"]},"timeline":[{"kind":"published","date":"2019-10-22T13:40:42.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T03:51:21.305Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T19:59:46.119Z","stale":false,"partial":false}}