{"schemaVersion":3,"id":"SUSE-SU-2018:2690-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for libzypp, zypper\n\nThis update for libzypp, zypper, libsolv provides the following fixes:\n\nSecurity fixes in libzypp:\n\n- CVE-2018-7685: PackageProvider: Validate RPMs before caching (bsc#1091624, bsc#1088705)\n- CVE-2017-9269: Be sure bad packages do not stay in the cache (bsc#1045735)\n\nChanges in libzypp:\n\n- Update to version 17.6.4\n- Automatically fetch repository signing key from gpgkey url (bsc#1088037)\n- lsof: use '-K i' if lsof supports it (bsc#1099847,bsc#1036304)\n- Check for not imported keys after multi key import from rpmdb (bsc#1096217)\n- Flags: make it std=c++14 ready\n- Ignore /var, /tmp and /proc in zypper ps. (bsc#1096617)\n- Show GPGME version in log\n- Adapt to changes in libgpgme11-11.1.0 breaking the signature verification (bsc#1100427)\n- RepoInfo::provideKey: add report telling where we look for missing keys.\n- Support listing gpgkey URLs in repo files (bsc#1088037)\n- Add new report to request user approval for importing a package key\n- Handle http error 502 Bad Gateway in curl backend (bsc#1070851)\n- Add filesize check for downloads with known size (bsc#408814)\n- Removed superfluous space in translation (bsc#1102019)\n- Prevent the system from sleeping during a commit\n- RepoManager: Explicitly request repo2solv to generate application pseudo packages.\n- libzypp-devel should not require cmake (bsc#1101349)\n- Avoid zombies from ExternalProgram\n- Update ApiConfig\n- HardLocksFile: Prevent against empty commit without Target having\n  been been loaded (bsc#1096803)\n- lsof: use '-K i' if lsof supports it (bsc#1099847)\n- Add filesize check for downloads with known size (bsc#408814)\n- Fix detection of metalink downloads and prevent aborting if a metalink file\n  is larger than the expected data file.\n- Require libsolv-devel >= 0.6.35 during build (fixing bsc#1100095)\n- Make use of %license macro (bsc#1082318)\n\nSecurity fix in zypper:\n\n- CVE-2017-9269: Improve signature check callback messages (bsc#1045735)\n\nChanges in zypper:\n\n- Always set error status if any nr of unknown repositories are passed to lr and ref (bsc#1093103)\n- Notify user about unsupported rpm V3 keys in an old rpm database (bsc#1096217)\n- Detect read only filesystem on system modifying operations (fixes #199)\n- Use %license (bsc#1082318)\n- Handle repo aliases containing multiple ':' in the PackageArgs parser (bsc #1041178)\n- Fix broken display of detailed query results.\n- Fix broken search for items with a dash. (bsc#907538, bsc#1043166, bsc#1070770)\n- Disable repository operations when searching installed packages. (bsc#1084525)\n- Prevent nested calls to exit() if aborted by a signal. (bsc#1092413)\n- ansi.h: Prevent ESC sequence strings from going out of scope. (bsc#1092413)\n- Fix some translation errors.\n- Support listing gpgkey URLs in repo files (bsc#1088037)\n- Check for root privileges in zypper verify and si (bsc#1058515)\n- XML <install-summary> attribute `packages-to-change` added (bsc#1102429)\n- Add expert (allow-*) options to all installer commands (bsc#428822)\n- Sort search results by multiple columns (bsc#1066215)\n- man: Strengthen that `--config FILE' affects zypper.conf, not zypp.conf (bsc#1100028)\n- Set error status if repositories passed to lr and ref are not known (bsc#1093103)\n- Do not override table style in search\n- Fix out of bound read in MbsIterator\n- Add --supplements switch to search and info\n- Add setter functions for zypp cache related config values to ZConfig\n\nChanges in libsolv:\n\n- convert repo2solv.sh script into a binary tool\n- Make use of %license macro (bsc#1082318)","dates":{"published":"2018-09-11T13:50:37.000Z","modified":"2026-02-04T03:21:06.419Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"libsolv&distro=SUSE Linux Enterprise Module for Basesystem 15","name":"libsolv","label":"libsolv&distro=SUSE Linux Enterprise Module for Basesystem 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libsolv&distro=SUSE Linux Enterprise Module for Basesystem 15","purlType":"rpm","versions":[{"text":"< 0.6.35-3.5.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.35-3.5.2","eol":null,"hubHref":null},{"vendor":"suse","product":"libsolv&distro=SUSE Linux Enterprise Module for Development Tools 15","name":"libsolv","label":"libsolv&distro=SUSE Linux Enterprise Module for Development Tools 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libsolv&distro=SUSE Linux Enterprise Module for Development Tools 15","purlType":"rpm","versions":[{"text":"< 0.6.35-3.5.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.6.35-3.5.2","eol":null,"hubHref":null},{"vendor":"suse","product":"libzypp&distro=SUSE Linux Enterprise Module for Basesystem 15","name":"libzypp","label":"libzypp&distro=SUSE Linux Enterprise Module for Basesystem 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libzypp&distro=SUSE Linux Enterprise Module for Basesystem 15","purlType":"rpm","versions":[{"text":"< 17.6.4-3.10.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.6.4-3.10.1","eol":null,"hubHref":null},{"vendor":"suse","product":"zypper&distro=SUSE Linux Enterprise Module for Basesystem 15","name":"zypper","label":"zypper&distro=SUSE Linux Enterprise Module for Basesystem 15","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/zypper&distro=SUSE Linux Enterprise Module for Basesystem 15","purlType":"rpm","versions":[{"text":"< 1.14.10-3.7.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.14.10-3.7.1","eol":null,"hubHref":null}],"affectedCount":4,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20182690-1/","label":"www.suse.com/support/update/announcement/2018/suse-su-20182690-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1036304","label":"bugzilla.suse.com/1036304","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1041178","label":"bugzilla.suse.com/1041178","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1043166","label":"bugzilla.suse.com/1043166","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1045735","label":"bugzilla.suse.com/1045735","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1058515","label":"bugzilla.suse.com/1058515","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1066215","label":"bugzilla.suse.com/1066215","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1070770","label":"bugzilla.suse.com/1070770","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1070851","label":"bugzilla.suse.com/1070851","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1082318","label":"bugzilla.suse.com/1082318","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1084525","label":"bugzilla.suse.com/1084525","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1088037","label":"bugzilla.suse.com/1088037","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1088705","label":"bugzilla.suse.com/1088705","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1091624","label":"bugzilla.suse.com/1091624","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1092413","label":"bugzilla.suse.com/1092413","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1093103","label":"bugzilla.suse.com/1093103","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1096217","label":"bugzilla.suse.com/1096217","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1096617","label":"bugzilla.suse.com/1096617","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1096803","label":"bugzilla.suse.com/1096803","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1099847","label":"bugzilla.suse.com/1099847","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1100028","label":"bugzilla.suse.com/1100028","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1100095","label":"bugzilla.suse.com/1100095","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1100427","label":"bugzilla.suse.com/1100427","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1101349","label":"bugzilla.suse.com/1101349","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1102019","label":"bugzilla.suse.com/1102019","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1102429","label":"bugzilla.suse.com/1102429","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/408814","label":"bugzilla.suse.com/408814","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/428822","label":"bugzilla.suse.com/428822","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/907538","label":"bugzilla.suse.com/907538","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2017-9269","label":"www.suse.com/security/cve/CVE-2017-9269","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7685","label":"www.suse.com/security/cve/CVE-2018-7685","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2017-9269","CVE-2018-7685"],"downstream":[],"duplicates":[],"related":["CVE-2017-9269","CVE-2018-7685"]},"timeline":[{"kind":"published","date":"2018-09-11T13:50:37.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-04T03:21:06.419Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T05:50:17.825Z","stale":false,"partial":false}}