Threats Tagged 'cve-2026-9149'

CVE-2026-25707 is a high severity vulnerability in SUSE libzypp before version 17.38.10. It involves a relative path traversal flaw when processing repository metadata, which could allow remote attackers supplying malicious repositories to overwrite files on the system. This can lead to denial of service or privilege escalation.

This security update addresses multiple vulnerabilities in libsolv, libzypp, and zypper components used by SUSE. The fixed issues include heap and stack-based buffer overflows, path traversal vulnerabilities, and arbitrary local file overwrite risks caused by crafted repository metadata or malformed files. The update also improves robustness against malformed repository data and enforces restrictions on repository path entries to prevent directory traversal outside allowed locations. These fixes mitigate potential crashes, memory corruption, and unauthorized file modifications.

This update includes the following RPMs: libsolv: * libsolv-0.7.38-2.hum1 (aarch64, x86_64) * libsolv-demo-0.7.38-2.hum1 (aarch64, x86_64) * libsolv-devel-0.7.38-2.hum1 (aarch64, x86_64) * libsolv-tools-0.7.38-2.hum1 (aarch64, x86_64) * libsolv-tools-base-0.7.38-2.hum1 (aarch64, x86_64) * perl-solv-0.7.38-2.hum1 (aarch64, x86_64) * python3-solv-0.7.38-2.hum1 (aarch64, x86_64) * ruby-solv-0.7.38-2.hum1 (aarch64, x86_64) * libsolv-0.7.38-2.hum1.src (src)

A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).