SUSE-SU-2025:0370-1

Details

This update for curl fixes the following issues:

CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)

Affected Packages

curl

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Installer Updates 15 SP4

Fixed in:

8.0.1-150400.5.62.1

libcurl-devel

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

8.0.1-150400.5.62.1

libcurl4

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Installer Updates 15 SP4

Fixed in:

8.0.1-150400.5.62.1

libcurl4-32bit

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

8.0.1-150400.5.62.1

References

REPORT

https://bugzilla.suse.com/1236588

REPORT

https://bugzilla.suse.com/1236590

WEB

https://www.suse.com/security/cve/CVE-2025-0167

WEB

https://www.suse.com/security/cve/CVE-2025-0725

ADVISORY

https://www.suse.com/support/update/announcement/2025/suse-su-20250370-1/