curl bug fix and enhancement update

An update is available for curl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.5...

curl: Buffer Overflow in curl's Rustls Backend

Summary: summary of the vulnerability A buffer overflow vulnerability exists in the curl library's Rustls backend due to an integer overflow in the dynamic buffer management. This issue could potentially allow an attacker to overwrite memory, leading to application crashes or, in theory, arbitrar...

curl: Free of uninitialized pointer in doh_decode_rdata_name()

dohdecoderdataname lib/doh.c frees an uninitialized pointer under certain conditions. If the remaining buffer length remaining is bufr; but s-bufr isn't initialized when line 1033 calls it. The bug is that line 1036 should be at the beginning of the function. To illustrate the issue using Visual...

CVE-2025-0725 affecting package curl for versions less than 8.11.1-3

CVE-2025-0725 affecting package curl for versions less than 8.11.1-3. A patched version of the package is available...

CVE-2025-0167 affecting package curl for versions less than 8.11.1-3

CVE-2025-0167 affecting package curl for versions less than 8.11.1-3. A patched version of the package is available...

CVE-2025-0665 affecting package curl for versions less than 8.11.1-3

CVE-2025-0665 affecting package curl for versions less than 8.11.1-3. A patched version of the package is available...

CVE-2024-11053 affecting package curl for versions less than 8.11.1-1

CVE-2024-11053 affecting package curl for versions less than 8.11.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-6874 affecting package curl for versions less than 8.8.0-1

CVE-2024-6874 affecting package curl for versions less than 8.8.0-1. A patched version of the package is available...

Security update for curl

This update for curl fixes the following issues: Update to 8.12.1: Bugfixes: asyn-thread: fix build with 'CURLDISABLESOCKETPAIR' asyn-thread: fix HTTPS RR crash asyn-thread: fix the returned bitmask from Curlresolvergetsock asyn-thread: survive a c-ares channel set to NULL cmake: always reference...

SUSE-SU-2025:20239-1 Security update for curl

This update for curl fixes the following issues: Update to 8.12.1: Bugfixes: - asyn-thread: fix build with 'CURLDISABLESOCKETPAIR' - asyn-thread: fix HTTPS RR crash - asyn-thread: fix the returned bitmask from Curlresolvergetsock - asyn-thread: survive a c-ares channel set to NULL - cmake: always...

Siemens SIMATIC S7-1500 and S7-1200 Use After Free (CVE-2021-22901)

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client...

SUSE-SU-2025:20144-1 Security update for curl

This update for curl fixes the following issues: Security issues fixed: - CVE-2025-0725: Fixed gzip integer overflow bsc1236590 - CVE-2025-0167: Fixed netrc and default credential leak bsc1236588 Other issues fixed: - Make sure the TLS handshake after a successful STARTTLS command is fully done...

UniRide Vehicle Booking Management System 1.0 Shell Upload

UniRide Vehicle Booking Management System version 1.0 suffers from a remote shell upload vulnerability. ============================================================================================================================================= | Title : UniRide Vehicle Booking Management System...

Zucchetti Ad Hoc Infinity 安全漏洞

Zucchetti Ad Hoc Infinity is an ERP software from Zucchetti. A security vulnerability exists in Zucchetti Ad Hoc Infinity version 2.4 that stems from improper checking of the mcURL parameter, which could result in a victim being redirected to an attacker-controlled website...

curl: Improper Restriction of Authentication Attempts in cURL

Summary: The authentication mechanism in cURL does not properly restrict the number of failed authentication attempts, allowing an attacker to brute-force credentials. This issue affects authentication-based requests and could lead to unauthorized access if an attacker successfully guesses a vali...

Linux Distros Unpatched Vulnerability : CVE-2025-0167

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under...

Linux Distros Unpatched Vulnerability : CVE-2024-9681

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than otherwise...

curl: Memory leak of ftp (with proxy reuse)

Summary: summary of the vulnerability There is a memory leak with FTP see reproducer and stack trace I found it via fuzzing with https://github.com/catenacyber/curl-fuzzer/tree/proxy after fixing a small memory leak in curl Just reporting a bit raw, not sure this is not just a small leak that doe...

Linux Distros Unpatched Vulnerability : CVE-2023-23914

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A cleartext transmission of sensitive information vulnerability exists in curl v7.88.0 that could cause HSTS functionality fail when multiple URLs are requested...

Linux Distros Unpatched Vulnerability : CVE-2023-27534

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A path traversal vulnerability exists in curl 8.0.0 SFTP implementation causes the tilde character to be wrongly replaced when used as a prefix in the first pat...