12543 matches found
CVE-2025-0167
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
CVE-2025-0167 vulnerabilities
Vulnerabilities for packages: curl...
CVE-2025-0665 vulnerabilities
Vulnerabilities for packages: curl...
CVE-2025-0167 vulnerabilities
Vulnerabilities for packages: curl...
CVE-2025-0665 vulnerabilities
Vulnerabilities for packages: curl...
DEBIAN-CVE-2025-0167
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
DEBIAN-CVE-2025-0665
libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve...
CVE-2025-0725 vulnerabilities
Vulnerabilities for packages: curl...
AZL-56504 CVE-2025-0725 affecting package curl for versions less than 8.11.1-3
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the CURLOPTACCEPTENCODING option, using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would make libcurl perform a buffer overflow...
CVE-2025-0725 vulnerabilities
Vulnerabilities for packages: curl...
CVE-2025-0167
The curl package is vulnerable to a flaw where it could leak a password from a .netrc file to a followed-to host during HTTP redirects. This specific issue occurs only when the .netrc file contains a default entry that omits both the login and password, which is a rare circumstance. Impacted envi...
CVE-2025-0167 netrc and default credential leak
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
CVE-2025-0167 netrc and default credential leak
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
CVE-2025-0167
When asked to use a ".netrc" file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a "default" entry that omits both login and password. A...
CVE-2025-0167 netrc and default credential leak
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
CVE-2025-0167
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
CURL-CVE-2025-0167 netrc and default credential leak
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
netrc and default credential leak
When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a default entry that omits both login and password. A rare...
gzip integer overflow
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the CURLOPTACCEPTENCODING option, using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would make libcurl perform a buffer overflow...
curl security vulnerabilities
curl is a cURL open source tool for transferring data from or to a server. A security vulnerability exists in curl versions 7.76.0 through 8.11.1, which stems from the fact that when using a .netrc file and following an HTTP redirect, it is possible to disclose passwords to the target host of the...