CVE-2018-7685: falha de alta gravidade em SUSE libzypp
libzypp does not reevaluate malicious rpms once downloaded
Publicada em · Atualizada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.8epss 0.3%
probabilidade de exploração
0.3%top 78% das CVEs
exploração observada
nãonenhuma fonte reporta
The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Produtos afetados
SUSE · libzyppCVEs relacionadas — SUSE libzypp
No mesmo produto, das mais perigosas para as menos.
CVE-2017-9269HIGHlack of keypinning in libzypp could lead to repository switchingEPSS 2.2%CVE-2017-7436HIGHlibzypp accepts unsigned packages even when configured to check signaturesEPSS 1.8%CVE-2017-7435HIGHlibzypp accepts unsigned 3rd party repo without warningEPSS 1.8%CVE-2026-25707HIGHHandcrafted repo metadata may cause arbitrary local files to be overwritten by libzyppEPSS 0.6%CVE-2026-44941HIGHlibzypp path traversal via "keyhint" in repomd.xmlEPSS 0.5%CVE-2026-44942MEDIUMlibzypp .repo files can have an optional path which can lead to path traversal attacksEPSS 0.4%