Security update for libzypp, libsolv

Announcement ID: SUSE-SU-2026:21992-1
Release Date: 2026-06-02T16:20:17Z
Rating: important
References:
Cross-References:
CVSS scores:
  • CVE-2026-25707 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  • CVE-2026-48863 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  • CVE-2026-48863 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  • CVE-2026-9149 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  • CVE-2026-9149 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  • CVE-2026-9149 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  • CVE-2026-9150 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  • CVE-2026-9150 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected Products:
  • SUSE Linux Micro 6.1

An update that solves four vulnerabilities can now be installed.

Description:

This update for libzypp, libsolv fixes the following issues:

libsolv was updated to 0.7.39.

  • fix solv_chksum_free segfault when called with a NULL pointer
  • made repo_add_solv more robust against corrupt files [bsc#1265935] [CVE-2026-9149]
  • fix potential buffer overflow when verifying EdDSA signatures [bsc#1266039] [CVE-2026-48863]
  • added limit checks in multiple places to catch overflows
  • reduce the size of the language id cache
  • fixed Debian canon selection
  • fixed dbpath detection in repo_rpmdb_librpm
  • reduced stack usage in repo page compression (needed for musl)
  • fixed in earlier release: [bsc#1265938] [CVE-2026-9150]
  • fix parsing of recommends in the old Mandriva synthesis format

libzypp was updated to 17.38.11:

  • Fix potential crash on malformed or malicious repository metadata (fixes #740)
  • Repo metadata: discard entries referring to a location outside the repo (bsc#1259802, CVE-2026-25707) Mirroring those data locally would refer to a location outside the repo's local cache directory. Those data entries are reported and discarded.
  • zypp.conf: Allow [env] section to add environment variables. This feature is designed to enable environment-specific settings or debugging options over an extended period. See zypp.conf(5).

Special Instructions and Notes:

Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  • SUSE Linux Micro 6.1
    zypper in -t patch SUSE-SLE-Micro-6.1-560=1

Package List:

  • SUSE Linux Micro 6.1 (aarch64 ppc64le s390x x86_64)
    • libzypp-debuginfo-17.38.11-slfo.1.1_1.1
    • libsolv-tools-base-debuginfo-0.7.39-slfo.1.1_1.1
    • libsolv-debugsource-0.7.39-slfo.1.1_1.1
    • libsolv-tools-base-0.7.39-slfo.1.1_1.1
    • libzypp-debugsource-17.38.11-slfo.1.1_1.1
    • libzypp-17.38.11-slfo.1.1_1.1

References: