H2O 安全漏洞

H2O is an in-memory platform for distributed, scalable machine learning open-sourced by H2O.ai. A security vulnerability exists in H2O version 3.46.0.2, which stems from improper handling of large GZIP files and could lead to a denial of service...

SUSE-SU-2025:20144-1 Security update for curl

This update for curl fixes the following issues: Security issues fixed: - CVE-2025-0725: Fixed gzip integer overflow bsc1236590 - CVE-2025-0167: Fixed netrc and default credential leak bsc1236588 Other issues fixed: - Make sure the TLS handshake after a successful STARTTLS command is fully done...

Security update for curl

This update for curl fixes the following issues: Security issues fixed: CVE-2025-0725: Fixed gzip integer overflow bsc1236590 CVE-2025-0167: Fixed netrc and default credential leak bsc1236588 Other issues fixed: Make sure the TLS handshake after a successful STARTTLS command is fully done before...

Linux Distros Unpatched Vulnerability : CVE-2025-0725

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the CURLOPTACCEPTENCODING option, using zlib 1.2.0.3 or...

Linux Distros Unpatched Vulnerability : CVE-2006-4335

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Array index error in the maketable function in unlzh.c in the LZH decompression component in gzip 1.3.5, when running on certain platforms, allows...

Linux Distros Unpatched Vulnerability : CVE-2006-4337

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer overflow in the maketable function in the LHZ component in gzip 1.3.5 allows context-dependent attackers to execute arbitrary code via a crafted decoding...

ROS-20250226-34

A vulnerability in the gzipdowrite function of the zlib compression library of the cURL command-line utility is related to an integer overflow. Exploitation of the vulnerability could allow an attacker acting remotely, bypass the ASLR protection mechanism, execute arbitrary code, or cause a denia...

Siemens SIMATIC S7-1500 TM MFP BIOS Improper Handling of Exceptional Conditions (CVE-2021-28831)

decompressgunzip.c in BusyBox through 1.32.1 mishandles the error bit on the huftbuild result pointer, with a resultant invalid free or segmentation fault, via malformed gzip data. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more informatio...

Advisory ROSA-SA-2025-2701

Software: gzip 1.9 OS: ROSA Virtualization 3.0 packageevrstring: gzip-1.9 CVE-ID: CVE-2022-1271 BDU-ID: 2022-02113 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the gzip library is related to errors in file name handling. Exploitation of the vulnerability could allow an attacker acting remotely to...

Tenable Identity Exposure < 3.77.9 Multiple Vulnerabilities (TNS-2025-01)

The version of the Tenable Identity Exposure running on the remote host is prior to 3.77.9. It is, therefore, affected by multiple vulnerabilities according to advisory TNS-2025-01, including the following: - libcurl would wrongly close the same eventfd file descriptor twice when taking down a...

openSUSE Security Advisory (SUSE-SU-2025:0369-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 4054-1] tryton-client security update

Debian LTS Advisory DLA-4054-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert February 16, 2025 https://wiki.debian.org/LTS Package : tryton-client Version : 5.0.33-1+deb11u1 CVE ID : not yet available Debian Bug : none Cédric Krier has found that trytond, the...

gzip integer overflow

...

CBL Mariner 2.0 Security Update: curl / mysql (CVE-2025-0725)

The version of curl / mysql installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-0725 advisory. - When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with th...

Buffer Overflow

libcurl.so is vulnerable to a Buffer Overflow. The vulnerability is due to an attacker-controlled integer overflow due to the use of zlib when performing automatic gzip decompression with the CURLOPTACCEPTENCODING option, leading to a potential buffer overflow...

SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2025:0370-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:0370-1 advisory. - CVE-2025-0725: Fixed gzip integer overflow bsc1236590 - CVE-2025-0167: Fixed netrc and default credential le...

CVE-2025-0725

A flaw was found in libcurl. This vulnerability allows an attacker to trigger a buffer overflow via an integer overflow in zlib 1.2.0.3 or older when libcurl performs automatic gzip decompression. Mitigation Mitigation for this issue is either not available or the currently available options do n...

SUSE CVE-2025-0725

When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the CURLOPTACCEPTENCODING option, using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would make libcurl perform a buffer overflow...

[slackware-security] curl

New curl packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/curl-8.12.0-i586-1slack15.0.txz: Upgraded. This release fixes the following security issues: gzip integer overflow eventfd double close...

Security update for curl

This update for curl fixes the following issues: CVE-2025-0725: Fixed gzip integer overflow bsc1236590 CVE-2025-0167: Fixed netrc and default credential leak bsc1236588 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...