CVE catalog

CVE-2017-7435

libzypp: CVE-2017-7435

[CVE catalog]

Severity
High · CVSS 8.1CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.81% · Oct 25, 2026

In libzypp before 20170803 it was possible to add unsigned YUM repositories without warning to the user that could lead to man in the middle or malicious servers to inject malicious RPM packages into a users system.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibzyppsid17.38.16-1fixed
Debianlibzyppforky17.38.16-1fixed
Debianlibzypptrixie17.36.7-1fixed
Debianlibzyppbookworm17.25.7-2.4fixed
Ubuntulibzypp16.0415.3.0-1build1vulnerable
Opensuselibzypptumbleweed17.28.4-1.2fixed
Suselibzypplinux enterprise server for sap applications 12 sp115.25.17-46.22.1fixed
Susezypperlinux enterprise server for sap applications 12 sp11.12.59-46.10.1fixed
Suselibzypplinux enterprise server 12 sp1-ltss15.25.17-46.22.1fixed
Susezypperlinux enterprise server 12 sp1-ltss1.12.59-46.10.1fixed
Suselibzypplinux enterprise server 12-ltss14.45.17-2.82.1fixed
Susezypperlinux enterprise server 12-ltss1.11.70-2.69.2fixed
Suselibzypplinux enterprise desktop 12 sp316.15.3-2.3.1fixed
Suseyast2-pkg-bindingslinux enterprise desktop 12 sp33.2.4-2.3.1fixed
Suselibzypplinux enterprise software development kit 12 sp316.15.3-2.3.1fixed
Suseyast2-pkg-bindings-devel-doclinux enterprise software development kit 12 sp33.2.4-2.3.1fixed
Suselibzypplinux enterprise server 12 sp316.15.3-2.3.1fixed
Suseyast2-pkg-bindingslinux enterprise server 12 sp33.2.4-2.3.1fixed
Suselibzypplinux enterprise server for sap applications 12 sp316.15.3-2.3.1fixed
Suseyast2-pkg-bindingslinux enterprise server for sap applications 12 sp33.2.4-2.3.1fixed
Suselibzypplinux enterprise desktop 12 sp216.15.2-27.21.1fixed
Susezypperlinux enterprise desktop 12 sp21.13.30-18.13.3fixed
Suselibzypplinux enterprise server for raspberry pi 12 sp216.15.2-27.21.1fixed
Susezypperlinux enterprise server for raspberry pi 12 sp21.13.30-18.13.3fixed
Suselibzypplinux enterprise software development kit 12 sp216.15.2-27.21.1fixed
Suselibzypplinux enterprise server 12 sp216.15.2-27.21.1fixed
Susezypperlinux enterprise server 12 sp21.13.30-18.13.3fixed
Suselibzypplinux enterprise server for sap applications 12 sp216.15.2-27.21.1fixed
Susezypperlinux enterprise server for sap applications 12 sp21.13.30-18.13.3fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibzyppsourcesid17.3.1-1not yet assignedNot reported[899065]
Debianlibzyppsourceforky17.3.1-1not yet assignedNot reported[899065]
Debianlibzyppsourcetrixie17.3.1-1not yet assignedNot reported[899065]
Debianlibzyppsourcebookworm17.3.1-1not yet assignedNot reported[899065]
Opensuselibzypprpmtumbleweed17.28.4-1.2Not reportedOPENSUSE-SU-2024:11019-1Not reported
Suselibzypprpmlinux enterprise server for sap applications 12 sp115.25.17-46.22.1Not reportedSUSE-SU-2018:2555-1Not reported
Susezypperrpmlinux enterprise server for sap applications 12 sp11.12.59-46.10.1Not reportedSUSE-SU-2018:2555-1Not reported
Suselibzypprpmlinux enterprise server 12 sp1-ltss15.25.17-46.22.1Not reportedSUSE-SU-2018:2555-1Not reported
Susezypperrpmlinux enterprise server 12 sp1-ltss1.12.59-46.10.1Not reportedSUSE-SU-2018:2555-1Not reported
Suselibzypprpmlinux enterprise server 12-ltss14.45.17-2.82.1Not reportedSUSE-SU-2018:2688-1Not reported
Susezypperrpmlinux enterprise server 12-ltss1.11.70-2.69.2Not reportedSUSE-SU-2018:2688-1Not reported
Suselibzypprpmlinux enterprise desktop 12 sp316.15.3-2.3.1Not reportedSUSE-SU-2017:2264-1Not reported
Suseyast2-pkg-bindingsrpmlinux enterprise desktop 12 sp33.2.4-2.3.1Not reportedSUSE-SU-2017:2264-1Not reported
Suselibzypprpmlinux enterprise software development kit 12 sp316.15.3-2.3.1Not reportedSUSE-SU-2017:2264-1Not reported
Suseyast2-pkg-bindings-devel-docrpmlinux enterprise software development kit 12 sp33.2.4-2.3.1Not reportedSUSE-SU-2017:2264-1Not reported
Suselibzypprpmlinux enterprise server 12 sp316.15.3-2.3.1Not reportedSUSE-SU-2017:2264-1Not reported
Suseyast2-pkg-bindingsrpmlinux enterprise server 12 sp33.2.4-2.3.1Not reportedSUSE-SU-2017:2264-1Not reported
Suselibzypprpmlinux enterprise server for sap applications 12 sp316.15.3-2.3.1Not reportedSUSE-SU-2017:2264-1Not reported
Suseyast2-pkg-bindingsrpmlinux enterprise server for sap applications 12 sp33.2.4-2.3.1Not reportedSUSE-SU-2017:2264-1Not reported
Suselibzypprpmlinux enterprise desktop 12 sp216.15.2-27.21.1Not reportedSUSE-SU-2017:2040-1Not reported
Susezypperrpmlinux enterprise desktop 12 sp21.13.30-18.13.3Not reportedSUSE-SU-2017:2040-1Not reported
Suselibzypprpmlinux enterprise server for raspberry pi 12 sp216.15.2-27.21.1Not reportedSUSE-SU-2017:2040-1Not reported
Susezypperrpmlinux enterprise server for raspberry pi 12 sp21.13.30-18.13.3Not reportedSUSE-SU-2017:2040-1Not reported
Suselibzypprpmlinux enterprise software development kit 12 sp216.15.2-27.21.1Not reportedSUSE-SU-2017:2040-1Not reported
Suselibzypprpmlinux enterprise server 12 sp216.15.2-27.21.1Not reportedSUSE-SU-2017:2040-1Not reported
Susezypperrpmlinux enterprise server 12 sp21.13.30-18.13.3Not reportedSUSE-SU-2017:2040-1Not reported
Suselibzypprpmlinux enterprise server for sap applications 12 sp216.15.2-27.21.1Not reportedSUSE-SU-2017:2040-1Not reported
Susezypperrpmlinux enterprise server for sap applications 12 sp21.13.30-18.13.3Not reportedSUSE-SU-2017:2040-1Not reported

[Debian bug #899065]

OpenFactory catalog packages

[openSUSE Tumbleweed]

  • [libzypp-devel]Unknown

    Source package: [libzypp]

    Details (1)

    • 17.38.14-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 17.28.4-1.2

      Version impact unknown

      dsa · libzypp · opensuse · tumbleweed

  • [libzypp-devel-doc]Unknown

    Source package: [libzypp]

    Details (1)

    • 17.38.14-1.2 · x86_64 · tumbleweed

      Unknown · Fixed: 17.28.4-1.2

      Version impact unknown

      dsa · libzypp · opensuse · tumbleweed

  • [libzypp]Fixed

    Source package: [libzypp]

    Details (1)

    • 17.38.14-1.2 · x86_64 · tumbleweed

      Fixed · Fixed: 17.28.4-1.2

      dsa · libzypp · opensuse · tumbleweed

[Debian 12 (Bookworm)]

  • [libzypp1722]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · amd64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · arm64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-bin]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · amd64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · arm64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-common]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-config]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-dev]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · amd64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · arm64 · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

  • [libzypp-doc]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

    • 17.25.7-2.4 · all · bookworm

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · bookworm; dsa · libzypp · debian · 12

[Debian 13 (Trixie)]

  • [libzypp1735]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · amd64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · arm64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

  • [libzypp-bin]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · amd64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · arm64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

  • [libzypp-common]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

  • [libzypp-config]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

  • [libzypp-dev]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · amd64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · arm64 · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

  • [libzypp-doc]Fixed

    Source package: [libzypp]

    Details (2)

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

    • 17.36.7-1 · all · trixie

      Fixed · Fixed: 17.3.1-1

      dsa · libzypp · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]