SUSE-SU-2022:1128-1

Security update for libsolv, libzypp

No scoreFix available

SUSE-SU-2022:1128-1 is a vulnerability with no CVSS score yet in libsolv, published April 7, 2022. No source lists public exploit code. Fixed in libsolv 0.6.39-2.27.32.2.

What does this mean?

Severity: UnratedNo CVSS score yet
Exploit chance: UnscoredNo EPSS score yet
Exploitation: None knownNot on CISA’s or ENISA’s lists
Fixed in: 0.6.39-2.27.32.2libsolv +1 more

Description

This update for libsolv, libzypp fixes the following issues:

libsolv to 0.6.39:

fix memory leaks in SWIG generated code
fix misparsing of '&' in attributes with libxml2
try to keep packages from a cycle close togther in the transaction order (bsc#1189622)
fix split provides not working if the update includes a forbidden vendor change (bsc#1195485)
fix segfault on conflict resolution when using bindings
do not replace noarch problem rules with arch dependent ones in problem reporting
fix and simplify pool_vendor2mask implementation
bump version to 0.6.39

libzypp to 16.22.4:

Hint on ptf resolver conflicts (bsc#1194848)
Fix package signature check (bsc#1184501) Pay attention that header and payload are secured by a valid signature and report more detailed which signature is missing.
Set ZYPP_RPM_DEBUG=1 to capture verbose rpm command output.

Affected packages

Affected packages
Package	Affected	Fixed
`libsolv` SUSE:Linux Enterprise Server 12 SP2-BCL	before 0.6.39-2.27.32.2	0.6.39-2.27.32.2
`libzypp` SUSE:Linux Enterprise Server 12 SP2-BCL	before 16.22.4-27.85.2	16.22.4-27.85.2

What each source reports

OSVNo score

Security update for libsolv, libzypp