Opensuse Zypper vulnerabilities

3 CVEs affecting Opensuse Zypper, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2017-9271, published 2018-03-01.

More from Opensuse.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2008-3187, published 2008-07-21. Medium severity, CVSS 5.0. EPSS: 1.7% chance of exploitation in the next 30 days. zypp-refresh-patches in zypper in SUSE openSUSE 10.2, 10.3, and 11.0 does not ask the user before accepting repository keys, which allows remote repositories to cause a denial of service (package…
• CVE-2012-0420, published 2013-12-02. Medium severity, CVSS 4.4. EPSS: 0.3% chance of exploitation in the next 30 days. zypp-refresh-wrapper in SUSE Zypper before 1.3.20 and 1.6.x before 1.6.166 allows local users to create files in arbitrary directories, or possibly have unspecified other impact, via a pathname in…
• CVE-2017-9271, published 2018-03-01. Low severity, CVSS 3.3. EPSS: 0.3% chance of exploitation in the next 30 days. The commandline package update tool zypper writes HTTP proxy credentials into its logfile, allowing local attackers to gain access to proxies used.