Alerts This Week
Warning Icon 1 640
Alerts This Week
Warning Icon 1 640

SUSE: curl Important Security Issues Update SUSE-SU-2025:03198-1

suse
Calendar Grey September 12, 2025
Dist Suse Esm H88
Important libxml2 enhancement resolving multiple vulnerabilities. Apply suggested updates to safeguard system security.
* bsc#1228260 * bsc#1236589 * bsc#1243397 * bsc#1243706 * bsc#1243933

Summary

## This update for curl fixes the following issues: Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056). Security issues fixed: * CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589). * CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397). * CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not easily noticed (bsc#1243706). * CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933). * CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN backend (bsc#1228260).

Topics%20covered

Topics Covered

security advisory security issue SuSE DoS important curl

References

* bsc#1228260

* bsc#1236589

* bsc#1243397

* bsc#1243706

* bsc#1243933

* bsc#1246197

* bsc#1249191

* bsc#1249348

* bsc#1249367

* jsc#PED-13055

* jsc#PED-13056

Cross-

* CVE-2024-6874

* CVE-2025-0665

* CVE-2025-10148

* CVE-2025-4947

* CVE-2025-5025

* CVE-2025-5399

* CVE-2025-9086

CVSS scores:

* CVE-2024-6874 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

* CVE-2024-6874 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

* CVE-2024-6874 ( NVD ): 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

* CVE-2025-0665 ( SUSE ): 5.3

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N

* CVE-2025-0665 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

* CVE-2025-0665 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

* CVE-2025-4947 ( SUSE ): 8.3

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2025:03198-1
Release Date: 2025-09-12T12:15:18Z
Rating: important

Topics%20covered

Topics Covered

security advisory security issue SuSE DoS important curl

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here