{"schemaVersion":3,"id":"SUSE-SU-2026:22172-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"Security update for zypper, libzypp, libsolv\n\nThis update for zypper, libzypp, libsolv fixes the following issues:\n\nChanges in zypper:\n\nUpdate to 1.14.98:\n\n- Transactional systems: Delegate rw-commands to\n  transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607)\n  On a transactional system where the root filesystem is mounted\n  read-only, zypper commands that modify the system cannot be\n  executed directly.\n  If the system provides a transactional-wrapper utility, zypper\n  will automatically attempt to invoke it. The wrapper\n  transparently executes the zypper command within a new, writable\n  snapshot and manages the lifecycle of that snapshot based on the\n  command's exit status.\n  On transactional systems lacking a transactional-wrapper, users\n  must manually invoke specialized tools -such as\n  transactional-update- to install, update, or remove software.\n- Add --filter-version-change to zypper lu.\n  Adds filtering by version change significance to reduce noise in\n  update listings. Supports levels: rebuild (hides rebuild-only\n  changes) and package (hides all release-only changes).\n- Autorefresh ris-services the way as plugin-services (bsc#1246504)\n  It's actually wrong to treat service refreshes different\n  depending on the service type. For the purpose of a service it\n  makes no difference how the data about the repos to use are\n  acquired.\n\nChanges in libzypp:\n\nUpdated to 17.38.13:\n\n- A .repo files \"path=\" entry must not refer to a location\n  outside the repo (bsc#1267874, CVE-2026-44942)\n  A \"path=\" entry may solely denote a sub-directory of the baseurl\n  where the metadata are located. A relative path trying to access\n  data outside the baseurl is reported and sanitized.\n- Repo \"keyhint\" must denote a filename, no path (bsc#1267426,\n  CVE-2026-44941)\n- Fix potential crash on malformed or malicious repository\n  metadata (fixes #740)\n- Repo metadata: discard entries referring to a location outside\n  the repo (bsc#1259802, CVE-2026-25707)\n  Mirroring those data locally would refer to a location outside\n  the repo's local cache directory. Those data entries are reported\n  and discarded.\n- zypp.conf: Allow [env] section to add environment variables.\n  This feature is designed to enable environment-specific settings\n  or debugging options over an extended period. See zypp.conf(5).\n- Prevent configured scripts from escaping the sigcheck directory\n  (bsc#1265223, CVE-2026-44933)\n- StringV: guard hasPrefix/hasPrefixCI against reading past the\n  view end (fixes #735)\n- Mandatory signature verification plugin support (PED#11922)\n- Fix purge-kernel -rc kernel handling (bsc#1239718)\n- Explicitly_set_pool_DISTTYPE_RPM (fixes #726)\n- Check for trusted key updates when updating the general keyring\n  (bsc#1259706)\n- Support multiple MirroredOrigin authorities (bsc#1253193)\n- Workaround doxygen bug: doxygen/doxygen#12057\n- libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842)\n\nChanges in libsolv:\n\nUpdated to 0.7.39:\n\n- fix solv_chksum_free segfault when called with a NULL pointer\n- made repo_add_solv more robust against corrupt files\n  [bsc#1265935] [CVE-2026-9149]\n- fix potential buffer overflow when verifying EdDSA signatures\n  [bsc#1266039] [CVE-2026-48863]\n- added limit checks in multiple places to catch overflows\n- reduce the size of the language id cache\n- fixed Debian canon selection\n- fixed dbpath detection in repo_rpmdb_librpm\n- reduced stack usage in repo page compression (needed for musl)\n- fix parsing of sha512 checksums in debian repositories\n  [bsc#1265938] [CVE-2026-9150]\n- improve speed of dirpool_add_dir makeing parsing of filelists.xml\n  twice as fast\n- fix parsing of recommends in the old Mandriva synthesis format","dates":{"published":"2026-06-19T07:11:35.000Z","modified":"2026-06-24T18:24:18.055Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"suse","product":"libsolv&distro=SUSE Linux Enterprise Server 16.0","name":"libsolv","label":"libsolv&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libsolv&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 0.7.39-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.39-160000.1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libsolv&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"libsolv","label":"libsolv&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libsolv&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 0.7.39-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.7.39-160000.1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libzypp&distro=SUSE Linux Enterprise Server 16.0","name":"libzypp","label":"libzypp&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libzypp&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 17.38.13-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.38.13-160000.1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libzypp&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"libzypp","label":"libzypp&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libzypp&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 17.38.13-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 17.38.13-160000.1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"zypper&distro=SUSE Linux Enterprise Server 16.0","name":"zypper","label":"zypper&distro=SUSE Linux Enterprise Server 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/zypper&distro=SUSE Linux Enterprise Server 16.0","purlType":"rpm","versions":[{"text":"< 1.14.98-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.14.98-160000.1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"zypper&distro=SUSE Linux Enterprise Server for SAP applications 16.0","name":"zypper","label":"zypper&distro=SUSE Linux Enterprise Server for SAP applications 16.0","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/zypper&distro=SUSE Linux Enterprise Server for SAP applications 16.0","purlType":"rpm","versions":[{"text":"< 1.14.98-160000.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.14.98-160000.1.1","eol":null,"hubHref":null}],"affectedCount":6,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622172-1/","label":"www.suse.com/support/update/announcement/2026/suse-su-202622172-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1239718","label":"bugzilla.suse.com/1239718","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1246504","label":"bugzilla.suse.com/1246504","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1253193","label":"bugzilla.suse.com/1253193","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1259706","label":"bugzilla.suse.com/1259706","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1259802","label":"bugzilla.suse.com/1259802","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1259842","label":"bugzilla.suse.com/1259842","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1265223","label":"bugzilla.suse.com/1265223","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1265935","label":"bugzilla.suse.com/1265935","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1265938","label":"bugzilla.suse.com/1265938","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1266039","label":"bugzilla.suse.com/1266039","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267426","label":"bugzilla.suse.com/1267426","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://bugzilla.suse.com/1267874","label":"bugzilla.suse.com/1267874","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25707","label":"www.suse.com/security/cve/CVE-2026-25707","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44933","label":"www.suse.com/security/cve/CVE-2026-44933","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44941","label":"www.suse.com/security/cve/CVE-2026-44941","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44942","label":"www.suse.com/security/cve/CVE-2026-44942","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-48863","label":"www.suse.com/security/cve/CVE-2026-48863","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9149","label":"www.suse.com/security/cve/CVE-2026-9149","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/security/cve/CVE-2026-9150","label":"www.suse.com/security/cve/CVE-2026-9150","hostname":"www.suse.com","tags":["WEB"]}],"lineage":{"upstream":["CVE-2026-25707","CVE-2026-44933","CVE-2026-44941","CVE-2026-44942","CVE-2026-48863","CVE-2026-9149","CVE-2026-9150"],"downstream":[],"duplicates":[],"related":["CVE-2026-25707","CVE-2026-44933","CVE-2026-44941","CVE-2026-44942","CVE-2026-48863","CVE-2026-9149","CVE-2026-9150"]},"timeline":[{"kind":"published","date":"2026-06-19T07:11:35.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-06-24T18:24:18.055Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T11:35:49.812Z","stale":false,"partial":false}}