SUSE-SU-2025:0370-1

Details

Description of the patch:

This update for curl fixes the following issues:

CVE-2025-0725: Fixed gzip integer overflow (bsc#1236590)
CVE-2025-0167: Fixed netrc and default credential leak (bsc#1236588)

Affected Packages

libcurl4

SUSE Linux Enterprise Desktop 15 SP4SUSE Linux Enterprise Desktop 15 SP5SUSE Linux Enterprise High Performance Computing 15 SP4SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSS

Fixed in:

8.0.1-150400.5.62.1

curl

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Micro 5.3

Fixed in:

8.0.1-150400.5.62.1

libcurl-devel

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

8.0.1-150400.5.62.1

libcurl4-32bit

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Server 15 SP4-LTSS

Fixed in:

8.0.1-150400.5.62.1

References

ADVISORY

https://bugzilla.suse.com/1236588

ADVISORY

https://bugzilla.suse.com/1236590

ADVISORY

https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2ECCI3BAXLHLUGPYD4ZUE4JHXTHZWYAK/

ADVISORY

https://www.suse.com/security/cve/CVE-2025-0167/

ADVISORY

https://www.suse.com/security/cve/CVE-2025-0725/

WEB

https://www.suse.com/support/security/rating/

ADVISORY

https://www.suse.com/support/update/announcement/2025/suse-su-20250370-1/