<div class="container">
<h1>Security update for zypper, libzypp, libsolv</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:22172-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-06-19T07:35:00Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1239718">bsc#1239718</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1246504">bsc#1246504</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1253193">bsc#1253193</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259706">bsc#1259706</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259802">bsc#1259802</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259842">bsc#1259842</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265223">bsc#1265223</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265935">bsc#1265935</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265938">bsc#1265938</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1266039">bsc#1266039</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267426">bsc#1267426</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267874">bsc#1267874</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/PED-13680">jsc#PED-13680</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/PED-15607">jsc#PED-15607</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-25707.html">CVE-2026-25707</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-44933.html">CVE-2026-44933</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-44941.html">CVE-2026-44941</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-44942.html">CVE-2026-44942</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-48863.html">CVE-2026-48863</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-9149.html">CVE-2026-9149</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-9150.html">CVE-2026-9150</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-25707</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44933</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.5</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44933</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.8</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44933</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">8.5</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44933</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.8</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44941</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44941</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.2</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44942</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.0</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44942</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44942</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48863</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-48863</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9149</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9149</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9149</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9150</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-9150</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves seven vulnerabilities, contains two features and has five fixes can now be installed.</p>
<h2>Description:</h2>
<p>This update for zypper, libzypp, libsolv fixes the following issues:</p>
<p>Changes in zypper:</p>
<p>Update to 1.14.98:</p>
<ul>
<li>Transactional systems: Delegate rw-commands to
transactional-wrapper if available (jsc#PED-13680, jsc#PED-15607)
On a transactional system where the root filesystem is mounted
read-only, zypper commands that modify the system cannot be
executed directly.
If the system provides a transactional-wrapper utility, zypper
will automatically attempt to invoke it. The wrapper
transparently executes the zypper command within a new, writable
snapshot and manages the lifecycle of that snapshot based on the
command's exit status.
On transactional systems lacking a transactional-wrapper, users
must manually invoke specialized tools -such as
transactional-update- to install, update, or remove software.</li>
<li>Add --filter-version-change to zypper lu.
Adds filtering by version change significance to reduce noise in
update listings. Supports levels: rebuild (hides rebuild-only
changes) and package (hides all release-only changes).</li>
<li>Autorefresh ris-services the way as plugin-services (bsc#1246504)
It's actually wrong to treat service refreshes different
depending on the service type. For the purpose of a service it
makes no difference how the data about the repos to use are
acquired.</li>
</ul>
<p>Changes in libzypp:</p>
<p>Updated to 17.38.13:</p>
<ul>
<li>A .repo files "path=" entry must not refer to a location
outside the repo (bsc#1267874, CVE-2026-44942)
A "path=" entry may solely denote a sub-directory of the baseurl
where the metadata are located. A relative path trying to access
data outside the baseurl is reported and sanitized.</li>
<li>Repo "keyhint" must denote a filename, no path (bsc#1267426,
CVE-2026-44941)</li>
<li>Fix potential crash on malformed or malicious repository
metadata (fixes #740)</li>
<li>Repo metadata: discard entries referring to a location outside
the repo (bsc#1259802, CVE-2026-25707)
Mirroring those data locally would refer to a location outside
the repo's local cache directory. Those data entries are reported
and discarded.</li>
<li>zypp.conf: Allow [env] section to add environment variables.
This feature is designed to enable environment-specific settings
or debugging options over an extended period. See zypp.conf(5).</li>
<li>Prevent configured scripts from escaping the sigcheck directory
(bsc#1265223, CVE-2026-44933)</li>
<li>StringV: guard hasPrefix/hasPrefixCI against reading past the
view end (fixes #735)</li>
<li>Mandatory signature verification plugin support (PED#11922)</li>
<li>Fix purge-kernel -rc kernel handling (bsc#1239718)</li>
<li>Explicitly_set_pool_DISTTYPE_RPM (fixes #726)</li>
<li>Check for trusted key updates when updating the general keyring
(bsc#1259706)</li>
<li>Support multiple MirroredOrigin authorities (bsc#1253193)</li>
<li>Workaround doxygen bug: doxygen/doxygen#12057</li>
<li>libzypp.spec: Add missing graphviz-gd BuildRequires (boo#1259842)</li>
</ul>
<p>Changes in libsolv:</p>
<p>Updated to 0.7.39:</p>
<ul>
<li>fix solv_chksum_free segfault when called with a NULL pointer</li>
<li>made repo_add_solv more robust against corrupt files
[bsc#1265935] [CVE-2026-9149]</li>
<li>fix potential buffer overflow when verifying EdDSA signatures
[bsc#1266039] [CVE-2026-48863]</li>
<li>added limit checks in multiple places to catch overflows</li>
<li>reduce the size of the language id cache</li>
<li>fixed Debian canon selection</li>
<li>fixed dbpath detection in repo_rpmdb_librpm</li>
<li>reduced stack usage in repo page compression (needed for musl)</li>
<li>fix parsing of sha512 checksums in debian repositories
[bsc#1265938] [CVE-2026-9150]</li>
<li>improve speed of dirpool_add_dir makeing parsing of filelists.xml
twice as fast</li>
<li>fix parsing of recommends in the old Mandriva synthesis format</li>
</ul>
<h2>Special Instructions and Notes:</h2>
<ul>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-961=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-961=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (ppc64le x86_64)
<ul>
<li>libsolv1-0.7.39-160000.1.1</li>
<li>libsolv-tools-base-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-tools-0.7.39-160000.1.1</li>
<li>zypper-debuginfo-1.14.98-160000.1.1</li>
<li>libzypp-17.38.13-160000.1.1</li>
<li>libsolv-devel-debuginfo-0.7.39-160000.1.1</li>
<li>perl-solv-0.7.39-160000.1.1</li>
<li>zypper-debugsource-1.14.98-160000.1.1</li>
<li>libzypp-devel-17.38.13-160000.1.1</li>
<li>ruby-solv-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-debugsource-0.7.39-160000.1.1</li>
<li>libsolv-devel-static-0.7.39-160000.1.1</li>
<li>python313-solv-debuginfo-0.7.39-160000.1.1</li>
<li>libzypp-devel-doc-17.38.13-160000.1.1</li>
<li>libzypp-debuginfo-17.38.13-160000.1.1</li>
<li>perl-solv-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-devel-0.7.39-160000.1.1</li>
<li>ruby-solv-0.7.39-160000.1.1</li>
<li>libsolv-debuginfo-0.7.39-160000.1.1</li>
<li>libzypp-debugsource-17.38.13-160000.1.1</li>
<li>python313-solv-0.7.39-160000.1.1</li>
<li>libsolv-demo-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-tools-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-tools-base-0.7.39-160000.1.1</li>
<li>libsolv1-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-demo-0.7.39-160000.1.1</li>
<li>zypper-1.14.98-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
<ul>
<li>zypper-aptitude-1.14.98-160000.1.1</li>
<li>zypper-needs-restarting-1.14.98-160000.1.1</li>
<li>zypper-log-1.14.98-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
<ul>
<li>libsolv1-0.7.39-160000.1.1</li>
<li>libsolv-tools-base-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-tools-0.7.39-160000.1.1</li>
<li>zypper-debuginfo-1.14.98-160000.1.1</li>
<li>libzypp-17.38.13-160000.1.1</li>
<li>libsolv-devel-debuginfo-0.7.39-160000.1.1</li>
<li>perl-solv-0.7.39-160000.1.1</li>
<li>zypper-debugsource-1.14.98-160000.1.1</li>
<li>libzypp-devel-17.38.13-160000.1.1</li>
<li>ruby-solv-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-debugsource-0.7.39-160000.1.1</li>
<li>libsolv-devel-static-0.7.39-160000.1.1</li>
<li>python313-solv-debuginfo-0.7.39-160000.1.1</li>
<li>libzypp-devel-doc-17.38.13-160000.1.1</li>
<li>libzypp-debuginfo-17.38.13-160000.1.1</li>
<li>perl-solv-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-devel-0.7.39-160000.1.1</li>
<li>ruby-solv-0.7.39-160000.1.1</li>
<li>libsolv-debuginfo-0.7.39-160000.1.1</li>
<li>libzypp-debugsource-17.38.13-160000.1.1</li>
<li>python313-solv-0.7.39-160000.1.1</li>
<li>libsolv-demo-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-tools-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-tools-base-0.7.39-160000.1.1</li>
<li>libsolv1-debuginfo-0.7.39-160000.1.1</li>
<li>libsolv-demo-0.7.39-160000.1.1</li>
<li>zypper-1.14.98-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>
<li>zypper-aptitude-1.14.98-160000.1.1</li>
<li>zypper-needs-restarting-1.14.98-160000.1.1</li>
<li>zypper-log-1.14.98-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-25707.html">https://www.suse.com/security/cve/CVE-2026-25707.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-44933.html">https://www.suse.com/security/cve/CVE-2026-44933.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-44941.html">https://www.suse.com/security/cve/CVE-2026-44941.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-44942.html">https://www.suse.com/security/cve/CVE-2026-44942.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-48863.html">https://www.suse.com/security/cve/CVE-2026-48863.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-9149.html">https://www.suse.com/security/cve/CVE-2026-9149.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-9150.html">https://www.suse.com/security/cve/CVE-2026-9150.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1239718">https://bugzilla.suse.com/show_bug.cgi?id=1239718</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1246504">https://bugzilla.suse.com/show_bug.cgi?id=1246504</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1253193">https://bugzilla.suse.com/show_bug.cgi?id=1253193</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259706">https://bugzilla.suse.com/show_bug.cgi?id=1259706</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259802">https://bugzilla.suse.com/show_bug.cgi?id=1259802</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1259842">https://bugzilla.suse.com/show_bug.cgi?id=1259842</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265223">https://bugzilla.suse.com/show_bug.cgi?id=1265223</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265935">https://bugzilla.suse.com/show_bug.cgi?id=1265935</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265938">https://bugzilla.suse.com/show_bug.cgi?id=1265938</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1266039">https://bugzilla.suse.com/show_bug.cgi?id=1266039</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267426">https://bugzilla.suse.com/show_bug.cgi?id=1267426</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267874">https://bugzilla.suse.com/show_bug.cgi?id=1267874</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-13680">https://jira.suse.com/browse/PED-13680</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-15607">https://jira.suse.com/browse/PED-15607</a>
</li>
</ul>
</div>