openSUSE Security Advisory (SUSE-SU-2025:0369-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-11053 affecting package curl for versions less than 8.8.0-4

CVE-2024-11053 affecting package curl for versions less than 8.8.0-4. A patched version of the package is available...

Advisory ROSA-SA-2025-2680

Software: curl 7.61.1 OS: ROSA Virtualization 3.0 packageevrstring: curl-7.61.1-33.0.2 CVE-ID: CVE-2023-27533 BDU-ID: 2023-02107 CVE-Crit: LOW CVE-DESC.: A vulnerability in the curl program line utility is related to communication using the TELNET protocol, which could allow an attacker to pass a...

OPENSUSE-SU-2025:14809-1 curl-8.12.1-1.1 on GA media

These are all security issues fixed in the curl-8.12.1-1.1 package on the GA media of openSUSE Tumbleweed...

curl bug fix update

An update is available for curl. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The curl packages provide the libcurl library and the curl utility for downloadi...

Multiple CURL vulnerabilities in Brocade SANnav OVA deployments before SANnav 2.3.1b

Multiple CURL vulnerabilities Curl 7.44.0 8.7.0 vulnerabilities CVE-2024-2398, CVE-2024-2466, CVE-2024-2004 & CVE-2024-0853 Curl 7.44.0 8.7.0 HTTP/2 Push Headers Memory-leak CVE-2024-2398 Curl 7.85.0 8.7.0 Input Misinterpretation CVE-2024-2004 Curl 7.85.0 8.7.0 Input Misinterpretation CVE-2024-20...

curl: Format string vulnerability, curl_msnprintf() function

Summary: A vulnerability has been identified in the curl library’s formatted output functions specifically in curlmsnprintf and its related functions. When a malicious attacker-controlled format string containing the %hn conversion specifier is passed, the function incorrectly attempts to write t...

Advisory ROSA-SA-2025-2679

Software: curl 7.61.1 OS: ROSA Virtualization 3.0 packageevrstring: curl-7.61.1-33.0.2 CVE-ID: CVE-2022-32221 BDU-ID: 2022-07403 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the cURL command line utility is related to a logical error in the reused descriptor when processing subsequent PUT an...

Astra Linux – Vulnerability in curl

When curl is instructed to use HSTS, the expiration time of a subdomain may overwrite the cache entry of the parent domain, causing it to expire sooner or later than intended. This issue affects curl when using applications that enable HSTS and utilize URLs with the insecure HTTP:// scheme. It al...

Credential Exposure

Curl is vulnerable to Credential Exposure. The vulnerability is due to improper handling of .netrc credentials due to the presence of a default entry without login and password, which can lead to the unintended leakage of credentials to redirected hosts...

Azure Linux 3.0 Security Update: cmake / curl / mysql (CVE-2024-2004)

The version of cmake / curl / mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-2004 advisory. - When a protocol selection parameter option disables all protocols without adding any then the...

Azure Linux 3.0 Security Update: cmake / curl (CVE-2024-2466)

The version of cmake / curl installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-2466 advisory. - libcurl did not check the server certificate of TLS connections done to a host specified as an IP...

Azure Linux 3.0 Security Update: cmake / curl / mysql / rust (CVE-2024-9681)

The version of cmake / curl / mysql / rust installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-9681 advisory. - When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent...

EulerOS 2.0 SP11 : curl (EulerOS-SA-2025-1151)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than...

Azure Linux 3.0 Security Update: cmake / curl / mysql / rust / tensorflow (CVE-2023-23916)

The version of cmake / curl / mysql / rust / tensorflow installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-23916 advisory. - An allocation of resources without limits or throttling vulnerability exis...

Curl 7.76.0 < 8.12.0 Default Credential Leak (CVE-2025-0167)

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...

Azure Linux 3.0 Security Update: cmake / curl / mysql (CVE-2023-46218)

The version of cmake / curl / mysql installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-46218 advisory. - This flaw allows a malicious HTTP server to set super cookies in curl that are then passed bac...

EulerOS 2.0 SP12 : curl (EulerOS-SA-2025-1186)

According to the versions of the curl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : When curl is asked to use HSTS, the expiry time for a subdomain might overwrite a parent domain's cache entry, making it end sooner or later than...

Curl < 8.12.0 Double Close (CVE-2025-0665)

libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 8090...

Azure Linux 3.0 Security Update: cmake / curl / mysql / rust / tensorflow (CVE-2022-43552)

The version of cmake / curl / mysql / rust / tensorflow installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2022-43552 advisory. - A use after free vulnerability exists in curl 7.87.0. Curl can be asked to...