CVE-2018-7685 PUBLISHED

The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.

EPSS 0.07% · 22.0th percentile

Risk Scores

EPSS Score
0.07%
22.0th percentile

Affected Products

VendorProductVersions
Ubuntu:16.04:LTSlibzypp0, 15.3.0-1build1

Timeline

References

Open in Interactive Console →