CVE-2018-7685 libzypp does not reevaluate malicious rpms once downloaded

HighCVSS 7.8 EPSS 0.30%

Published: 2018-08-31 18:00
Updated: 2026-10-23 21:04
Exploit status: No public exploit known

Description

The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.

Affected products

Product	Affected versions	Fixed in
debian/libzypp(Debian:12)	< 17.6.1-1	17.6.1-1
debian/libzypp(Debian:13)	< 17.6.1-1	17.6.1-1
debian/libzypp(Debian:14)	< 17.6.1-1	17.6.1-1
openSUSE libzypp	< 17.5.0	17.5.0
SUSE libzypp	< 17.5.0	17.5.0

References

Debian Security Tracker CVE-2018-7685 vendor-advisory
lists.suse.com
bugzilla.suse.com
www.suse.com

CVSS v3.0

7.8 High

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Local
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (5)

v3.0 7.8 · nvd@nist.gov
v3.0 7.8 · microfocus
v3.0 7.8 · security@opentext.com
v3.0 7.8 · osv:debian
v2.0 4.6 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 0.30% (percentile 22.7)
CWE: CWE-347 CWE-358

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.