SUSE alert openSUSE-SU-2026:21096-1 (zypper, libzypp, libsolv)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:21096-1: important: Security update for zypper, libzypp, libsolv
Date:
             
 
Tue, 30 Jun 2026 09:48:20 +0200
Message-ID:
             
 
<20260630074820.2B221FF4B@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for zypper, libzypp, libsolv
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21096-1
Rating: important
References:

  * bsc#1239718
  * bsc#1246504
  * bsc#1253193
  * bsc#1259706
  * bsc#1259802
  * bsc#1259842
  * bsc#1265223
  * bsc#1265935
  * bsc#1265938
  * bsc#1266039
  * bsc#1267426
  * bsc#1267874



Cross-References:

  * CVE-2026-25707
  * CVE-2026-44933
  * CVE-2026-44941
  * CVE-2026-44942
  * CVE-2026-48863
  * CVE-2026-9149
  * CVE-2026-9150



CVSS scores:

  * CVE-2026-25707 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-44933 ( SUSE ): 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-44933 ( SUSE ): 8.5 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-44941 ( SUSE ): 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-44941 ( SUSE ): 7.5 CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-44942 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-44942 ( SUSE ): 6 CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-48863 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-48863 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-9149 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-9150 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 7 vulnerabilities and has 12 bug fixes can now be installed.

Description:

This update for zypper, libzypp, libsolv fixes the following issues:

Changes in zypper:

Update to 1.14.98:

- Transactional systems: Delegate rw-commands to
  transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607)
  On a transactional system where the root filesystem is mounted
  read-only, zypper commands that modify the system cannot be
  executed directly.
  If the system provides a transactional-wrapper utility, zypper
  will automatically attempt to invoke it. The wrapper
  transparently executes the zypper command within a new, writable
  snapshot and manages the lifecycle of that snapshot based on the
  command's exit status.
  On transactional systems lacking a transactional-wrapper, users
  must manually invoke specialized tools -such as
  transactional-update- to install, update, or remove software.
- Add --filter-version-change to zypper lu.
  Adds filtering by version change significance to reduce noise in
  update listings. Supports levels: rebuild (hides rebuild-only
  changes) and package (hides all release-only changes).
- Autorefresh ris-services the way as plugin-services (bsc#1246504)
  It's actually wrong to treat service refreshes different
  depending on the service type. For the purpose of a service it
  makes no difference how the data about the repos to use are
  acquired.

Changes in libzypp:

Updated to 17.38.13:

- A .repo files "path=" entry must not refer to a location
  outside the repo (bsc#1267874, CVE-2026-44942)
  A "path=" entry may solely denote a sub-directory of the baseurl
  where the metadata are located. A relative path trying to access
  data outside the baseurl is reported and sanitized.
- Repo "keyhint" must denote a filename, no path (bsc#1267426,
  CVE-2026-44941)
- Fix potential crash on malformed or malicious repository
  metadata (fixes #740)
- Repo metadata: discard entries referring to a location outside
  the repo (bsc#1259802, CVE-2026-25707)
  Mirroring those data locally would refer to a location outside
  the repo's local cache directory. Those data entries are reported
  and discarded.
- zypp.conf: Allow [env] section to add environment variables.
  This feature is designed to enable environment-specific settings
  or debugging options over an extended period. See zypp.conf(5).
- Prevent configured scripts from escaping the sigcheck directory
  (bsc#1265223, CVE-2026-44933)
- StringV: guard hasPrefix/hasPrefixCI against reading past the
  view end (fixes #735)
- Mandatory signature verification plugin support (PED#11922)
- Fix purge-kernel -rc kernel handling (bsc#1239718)
- Explicitly_set_pool_DISTTYPE_RPM (fixes #726)
- Check for trusted key updates when updating the general keyring
  (bsc#1259706)
- Support multiple MirroredOrigin authorities (bsc#1253193)
- Workaround doxygen bug: doxygen/doxygen#12057
- libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842)

Changes in libsolv:

Updated to 0.7.39:

- fix solv_chksum_free segfault when called with a NULL pointer
- made repo_add_solv more robust against corrupt files
  [bsc#1265935] [CVE-2026-9149]
- fix potential buffer overflow when verifying EdDSA signatures
  [bsc#1266039] [CVE-2026-48863]
- added limit checks in multiple places to catch overflows
- reduce the size of the language id cache
- fixed Debian canon selection
- fixed dbpath detection in repo_rpmdb_librpm
- reduced stack usage in repo page compression (needed for musl)
- fix parsing of sha512 checksums in debian repositories
  [bsc#1265938] [CVE-2026-9150]
- improve speed of dirpool_add_dir makeing parsing of filelists.xml
  twice as fast
- fix parsing of recommends in the old Mandriva synthesis format


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-961=1

Package List:

- openSUSE Leap 16.0:

  libsolv-demo-0.7.39-160000.1.1
  libsolv-devel-0.7.39-160000.1.1
  libsolv-devel-static-0.7.39-160000.1.1
  libsolv-tools-0.7.39-160000.1.1
  libsolv-tools-base-0.7.39-160000.1.1
  libsolv1-0.7.39-160000.1.1
  libzypp-17.38.13-160000.1.1
  libzypp-devel-17.38.13-160000.1.1
  libzypp-devel-doc-17.38.13-160000.1.1
  perl-solv-0.7.39-160000.1.1
  python313-solv-0.7.39-160000.1.1
  ruby-solv-0.7.39-160000.1.1
  zypper-1.14.98-160000.1.1
  zypper-aptitude-1.14.98-160000.1.1
  zypper-log-1.14.98-160000.1.1
  zypper-needs-restarting-1.14.98-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2026-25707.html
  * https://www.suse.com/security/cve/CVE-2026-44933.html
  * https://www.suse.com/security/cve/CVE-2026-44941.html
  * https://www.suse.com/security/cve/CVE-2026-44942.html
  * https://www.suse.com/security/cve/CVE-2026-48863.html
  * https://www.suse.com/security/cve/CVE-2026-9149.html
  * https://www.suse.com/security/cve/CVE-2026-9150.html