Threats Tagged 'cve-2026-44933'

CVE-2026-25707 is a high severity vulnerability in SUSE libzypp before version 17.38.10. It involves a relative path traversal flaw when processing repository metadata, which could allow remote attackers supplying malicious repositories to overwrite files on the system. This can lead to denial of service or privilege escalation.

This security update addresses multiple vulnerabilities in libsolv, libzypp, and zypper components used by SUSE. The fixed issues include heap and stack-based buffer overflows, path traversal vulnerabilities, and arbitrary local file overwrite risks caused by crafted repository metadata or malformed files. The update also improves robustness against malformed repository data and enforces restrictions on repository path entries to prevent directory traversal outside allowed locations. These fixes mitigate potential crashes, memory corruption, and unauthorized file modifications.

CVE-2026-44933 is a path traversal vulnerability in SUSE Linux Enterprise where the PluginScript attempts to chroot to a root directory that is often the system root (/). When the chroot target is /, the operation is ineffective, allowing traversal paths to execute host binaries with root privileges. This vulnerability has a high severity score of 7.8 and affects version 17.38.8. No patch or official remediation information is currently available, and no known exploits are reported in the wild.