* bsc#1243397 * bsc#1243706 * bsc#1243933 * bsc#1246197 * jsc#PED-13055 . # Security update for curl Announcement ID: SUSE-SU-2025:20675-1 Release Date: 2025-09-09T10:22:04Z Rating: important References: * bsc#1243397 * bsc#1243706 * bsc#1243933 * bsc#1246197 * jsc#PED-13055 * jsc#PED-13056 Cross-References: * CVE-2025-4947 * CVE-2025-5025 * CVE-2025-5399 CVSS scores: * CVE-2025-4947 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-4947 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N * CVE-2025-4947 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2025-5025 ( SUSE ): 8.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-5025 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N * CVE-2025-5025 ( NVD ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N * CVE-2025-5399 ( SUSE ): 5.7 CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N * CVE-2025-5399 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2025-5399 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Affected Products: * SUSE Linux Micro 6.1 An update that solves three vulnerabilities, contains two features and has one fix can now be installed. ## Description: This update for curl fixes the following issues: * CVE-2025-5399: libcurl can possibly get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933). * CVE-2025-5025: No QUIC certificate pinning with wolfSSL (bsc#1243706). * CVE-2025-4947: QUIC certificate check skip with wolfSSL (bsc#1243397). Other bugfixes: * Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.1 zypper in -t patchSUSE-SLE-Micro-6.1-254=1 ## Package List: * SUSE Linux Micro 6.1 (aarch64 ppc64le s390x x86_64) * curl-debuginfo-8.14.1-slfo.1.1_1.1 * curl-debugsource-8.14.1-slfo.1.1_1.1 * curl-8.14.1-slfo.1.1_1.1 * libcurl4-8.14.1-slfo.1.1_1.1 * libcurl4-debuginfo-8.14.1-slfo.1.1_1.1 ## References: * https://www.suse.com/security/cve/CVE-2025-4947.html * https://www.suse.com/security/cve/CVE-2025-5025.html * https://www.suse.com/security/cve/CVE-2025-5399.html * https://bugzilla.suse.com/show_bug.cgi?id=1243397 * https://bugzilla.suse.com/show_bug.cgi?id=1243706 * https://bugzilla.suse.com/show_bug.cgi?id=1243933 * https://bugzilla.suse.com/show_bug.cgi?id=1246197 * https://jira.suse.com/login.jsp?permissionViolation=true&os_destination=%2Fbrowse%2FPED-13055&page_caps=&user_role= * https://jira.suse.com/login.jsp?permissionViolation=true&os_destination=%2Fbrowse%2FPED-13056&page_caps=&user_role= . SUSE has published a critical update for wget addressing major vulnerabilities related to service disruption and SSL/TLS certificate validation problems.. curl security update,SUSE advisory,curl busy-loop fix,SUSE Linux Micro,curl certificate check. . Severity: Important. LinuxSecurity.com Team
This update upgrades Thunderbird to version 102.7.1. * Mozilla: Revocation status of S/Mime signature certificates was not checked (CVE-2023-0430) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE SL7 x86_64 thunderbird-102.7.1-2.el7_9.x86_64.rpm thunderbird-debuginfo-102.7.1-2.el7_9.x86 [More...]. Synopsis: Important: thunderbird security update Advisory ID: SLSA-2023:0600-1 Issue Date: 2023-02-07 CVE Numbers: CVE-2023-0430 -- This update upgrades Thunderbird to version 102.7.1. Security Fix(es): * Mozilla: Revocation status of S/Mime signature certificates was not checked (CVE-2023-0430) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE -- SL7 x86_64 thunderbird-102.7.1-2.el7_9.x86_64.rpm thunderbird-debuginfo-102.7.1-2.el7_9.x86_64.rpm - Scientific Linux Development Team . Important Thunderbird patch for Scientific Linux SL7. Update to version 102.7.1 to resolve certificate validation issue.. Thunderbird Security Update, SL7 Fixes, Mozilla Certificate Checks. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.