{"id":"SUSE-SU-2022:1128-1","aliases":[],"status":"published","title":"Security update for libsolv, libzypp","description":"This update for libsolv, libzypp fixes the following issues:\n\nlibsolv to 0.6.39:\n\n- fix memory leaks in SWIG generated code\n- fix misparsing of '\u0026' in attributes with libxml2\n- try to keep packages from a cycle close togther in the\n  transaction order (bsc#1189622)\n- fix split provides not working if the update includes a\n  forbidden vendor change (bsc#1195485)\n- fix segfault on conflict resolution when using bindings\n- do not replace noarch problem rules with arch dependent ones\n  in problem reporting\n- fix and simplify pool_vendor2mask implementation\n- bump version to 0.6.39\n\nlibzypp to 16.22.4:\n\n- Hint on ptf resolver conflicts (bsc#1194848)\n- Fix package signature check (bsc#1184501)\n  Pay attention that header and payload are secured by a valid\n  signature and report more detailed which signature is missing.\n- Set ZYPP_RPM_DEBUG=1 to capture verbose rpm command output.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2022-04-07T14:19:28Z","modified":"2022-04-07T14:19:28Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libsolv","fixed_in":["0.6.39-2.27.32.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libzypp","fixed_in":["16.22.4-27.85.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libsolv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.39-2.27.32.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"libzypp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.22.4-27.85.2"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221128-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1184501","tags":["report"]},{"url":"https://bugzilla.suse.com/1189622","tags":["report"]},{"url":"https://bugzilla.suse.com/1194848","tags":["report"]},{"url":"https://bugzilla.suse.com/1195485","tags":["report"]}],"sources":{"osv":[{"id":"SUSE-SU-2022:1128-1","title":"Security update for libsolv, libzypp","description":"This update for libsolv, libzypp fixes the following issues:\n\nlibsolv to 0.6.39:\n\n- fix memory leaks in SWIG generated code\n- fix misparsing of '\u0026' in attributes with libxml2\n- try to keep packages from a cycle close togther in the\n  transaction order (bsc#1189622)\n- fix split provides not working if the update includes a\n  forbidden vendor change (bsc#1195485)\n- fix segfault on conflict resolution when using bindings\n- do not replace noarch problem rules with arch dependent ones\n  in problem reporting\n- fix and simplify pool_vendor2mask implementation\n- bump version to 0.6.39\n\nlibzypp to 16.22.4:\n\n- Hint on ptf resolver conflicts (bsc#1194848)\n- Fix package signature check (bsc#1184501)\n  Pay attention that header and payload are secured by a valid\n  signature and report more detailed which signature is missing.\n- Set ZYPP_RPM_DEBUG=1 to capture verbose rpm command output.\n","status":"published","published":"2022-04-07T14:19:28Z","modified":"2022-04-07T14:19:28Z","updated_at":"2026-11-02T15:53:50.513981Z"}]}}