SUSE-SU-2025:03268-1

UNKNOWN

Security update for curl

Published Sep 18, 2025

Modified 5 months ago

Fix available

Details

This update for curl fixes the following issues:

Security issues fixed:

CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer (bsc#1249191).
CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).

Other issues fixed:

Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
- tool_getparam: fix --ftp-pasv [5f805ee]
Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).
- TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
- websocket: add option to disable auto-pong reply.
- huge number of bugfixes.
Please see https://curl.se/ch/ for full changelogs.

Affected Packages(12 packages)

brotli

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS

Fixed in:

1.0.7-150200.3.5.1

curl

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Micro 5.1SUSE Linux Enterprise Micro 5.2SUSE Linux Enterprise Server 15 SP3-LTSS

Fixed in:

8.14.1-150200.4.91.1

libbrotli-devel

Fixed in:

1.0.7-150200.3.5.1

libbrotlicommon1

Fixed in:

1.0.7-150200.3.5.1

libbrotlicommon1-32bit

Fixed in:

1.0.7-150200.3.5.1

libbrotlidec1

Fixed in:

1.0.7-150200.3.5.1

libbrotlidec1-32bit

Fixed in:

1.0.7-150200.3.5.1

libbrotlienc1

Fixed in:

1.0.7-150200.3.5.1

libcurl-devel

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Server 15 SP3-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP3

Fixed in:

8.14.1-150200.4.91.1

libcurl4

SUSE Enterprise Storage 7.1SUSE Linux Enterprise High Performance Computing 15 SP3-LTSSSUSE Linux Enterprise Micro 5.1SUSE Linux Enterprise Micro 5.2SUSE Linux Enterprise Server 15 SP3-LTSS

Fixed in:

8.14.1-150200.4.91.1

References

REPORT

https://bugzilla.suse.com/1246197

REPORT

https://bugzilla.suse.com/1249191

REPORT

https://bugzilla.suse.com/1249348

REPORT

https://bugzilla.suse.com/1249367

WEB