Moderate Photon OS Security Update - PHSA-2025-4.0-0774

Updates of 'curl' packages of Photon OS have been released...

Exploit for CVE-2025-29927

Next.js POC for CVE-2025-29927 - Authorization Bypass in Ne...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2025-1289)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2025-1290)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When asked to both use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2025-1290)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for curl (EulerOS-SA-2025-1289)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RockyLinux 9 : mysql (RLSA-2025:1671)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:1671 advisory. openssl: SSLselectnextproto buffer overread CVE-2024-5535 krb5: GSS message token handling CVE-2024-37371 curl: libcurl: ASN.1 date parser overread...

curl: Double free caused by mqtt_doing()

mqttdoing lib/mqtt.c causes a double free under certain conditions. The conditions are 1 an mqttsend is unable to send its entire buffer at one time; and 2 the next call to mqttsend fails. The bug arises because mqttdoing frees the pointer mq-sendleftovers without nulling it line 755. Source belo...

curl bug fix and enhancement update

An update is available for curl. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Linux 9.5...

curl: Buffer Overflow in curl's Rustls Backend

Summary: summary of the vulnerability A buffer overflow vulnerability exists in the curl library's Rustls backend due to an integer overflow in the dynamic buffer management. This issue could potentially allow an attacker to overwrite memory, leading to application crashes or, in theory, arbitrar...

curl: Free of uninitialized pointer in doh_decode_rdata_name()

dohdecoderdataname lib/doh.c frees an uninitialized pointer under certain conditions. If the remaining buffer length remaining is bufr; but s-bufr isn't initialized when line 1033 calls it. The bug is that line 1036 should be at the beginning of the function. To illustrate the issue using Visual...

CVE-2025-0725 affecting package curl for versions less than 8.11.1-3

CVE-2025-0725 affecting package curl for versions less than 8.11.1-3. A patched version of the package is available...

CVE-2025-0167 affecting package curl for versions less than 8.11.1-3

CVE-2025-0167 affecting package curl for versions less than 8.11.1-3. A patched version of the package is available...

CVE-2025-0665 affecting package curl for versions less than 8.11.1-3

CVE-2025-0665 affecting package curl for versions less than 8.11.1-3. A patched version of the package is available...

CVE-2024-11053 affecting package curl for versions less than 8.11.1-1

CVE-2024-11053 affecting package curl for versions less than 8.11.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2024-6874 affecting package curl for versions less than 8.8.0-1

CVE-2024-6874 affecting package curl for versions less than 8.8.0-1. A patched version of the package is available...

Security update for curl

This update for curl fixes the following issues: Update to 8.12.1: Bugfixes: asyn-thread: fix build with 'CURLDISABLESOCKETPAIR' asyn-thread: fix HTTPS RR crash asyn-thread: fix the returned bitmask from Curlresolvergetsock asyn-thread: survive a c-ares channel set to NULL cmake: always reference...

SUSE-SU-2025:20239-1 Security update for curl

This update for curl fixes the following issues: Update to 8.12.1: Bugfixes: - asyn-thread: fix build with 'CURLDISABLESOCKETPAIR' - asyn-thread: fix HTTPS RR crash - asyn-thread: fix the returned bitmask from Curlresolvergetsock - asyn-thread: survive a c-ares channel set to NULL - cmake: always...

Siemens SIMATIC S7-1500 and S7-1200 Use After Free (CVE-2021-22901)

curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. A malicious server can use this in rare unfortunate circumstances to potentially reach remote code execution in the client...

SUSE-SU-2025:20144-1 Security update for curl

This update for curl fixes the following issues: Security issues fixed: - CVE-2025-0725: Fixed gzip integer overflow bsc1236590 - CVE-2025-0167: Fixed netrc and default credential leak bsc1236588 Other issues fixed: - Make sure the TLS handshake after a successful STARTTLS command is fully done...