Threats Tagged 'cve-2026-48863'

Multiple vulnerabilities affecting libsolv, libzypp, and zypper have been addressed in a security update by the SUSE Product Security Team. These include heap and stack-based buffer overflows, path traversal issues, arbitrary local file overwrite risks, and signature verification bypasses. The update introduces fixes such as sanitizing repository paths, discarding unsafe metadata entries, and improving robustness against malformed repository data. No CVSS score is provided, but the impact is considered high due to the nature of the vulnerabilities.

This security update addresses multiple vulnerabilities in libsolv, libzypp, and zypper components used by SUSE. The fixed issues include heap and stack-based buffer overflows, path traversal vulnerabilities, and arbitrary local file overwrite risks caused by crafted repository metadata or malformed files. The update also improves robustness against malformed repository data and enforces restrictions on repository path entries to prevent directory traversal outside allowed locations. These fixes mitigate potential crashes, memory corruption, and unauthorized file modifications.