Stay Secure with the Latest Linux Advisories

security advisorymoderatememory leak

SUSE Linux Micro 6.0: 2025:20029-1 moderate: curl security issues

* bsc#1221665 * bsc#1221666 * bsc#1221667 * bsc#1221668 * bsc#1227888 . # Security update for curl Announcement ID: SUSE-SU-2025:20029-1 Release Date: 2025-02-03T08:51:45Z Rating: moderate References: * bsc#1221665 * bsc#1221666 * bsc#1221667 * bsc#1221668 * bsc#1227888 * bsc#1228535 Cross-References: * CVE-2024-2004 * CVE-2024-2379 * CVE-2024-2398 * CVE-2024-2466 * CVE-2024-6197 * CVE-2024-7264 CVSS scores: * CVE-2024-2004 ( SUSE ): 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N * CVE-2024-2004 ( NVD ): 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N * CVE-2024-2379 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N * CVE-2024-2379 ( NVD ): 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L * CVE-2024-2398 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H * CVE-2024-2466 ( SUSE ): 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N * CVE-2024-6197 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H * CVE-2024-6197 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-6197 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2024-7264 ( SUSE ): 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L * CVE-2024-7264 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H * CVE-2024-7264 ( NVD ): 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L Affected Products: * SUSE Linux Micro 6.0 An update that solves six vulnerabilities can now be installed. ## Description: This update for curl fixes the following issues: Security issues fixed: * CVE-2024-7264: ASN.1 date parser overread (bsc#1228535) * CVE-2024-6197: Freeing stack buffer in utf8asn1str (bsc#1227888) * CVE-2024-2379: QUIC certificate check bypass with wolfSSL (bsc#1221666) * CVE-2024-2466: TLS certificate check bypass with mbedTLS (bsc#1221668) * CVE-2024-2004: Usage of disabled protocol (bsc#1221665) * CVE-2024-2398: HTTP/2 push headers memory-leak (bsc#1221667) Non-security issue fixed: * Fixedvarious TLS related issues including FTP over SSL transmission timeouts. ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.0 zypper in -t patch SUSE-SLE-Micro-6.0-30=1 ## Package List: * SUSE Linux Micro 6.0 (aarch64 s390x x86_64) * curl-8.6.0-3.1 * curl-debugsource-8.6.0-3.1 * curl-debuginfo-8.6.0-3.1 * libcurl4-debuginfo-8.6.0-3.1 * libcurl4-8.6.0-3.1 ## References: * https://www.suse.com/security/cve/CVE-2024-2004.html * https://www.suse.com/security/cve/CVE-2024-2379.html * https://www.suse.com/security/cve/CVE-2024-2398.html * https://www.suse.com/security/cve/CVE-2024-2466.html * https://www.suse.com/security/cve/CVE-2024-6197.html * https://www.suse.com/security/cve/CVE-2024-7264.html * https://bugzilla.suse.com/show_bug.cgi?id=1221665 * https://bugzilla.suse.com/show_bug.cgi?id=1221666 * https://bugzilla.suse.com/show_bug.cgi?id=1221667 * https://bugzilla.suse.com/show_bug.cgi?id=1221668 * https://bugzilla.suse.com/show_bug.cgi?id=1227888 * https://bugzilla.suse.com/show_bug.cgi?id=1228535 . Update for curl resolves six security concerns including TLS issues and authentication bypasses. Install for protection.. SUSE Linux Micro, curl security fix, TLS issues, certification bypass, software update. . LinuxSecurity.com Team

Jun 04, 2025 SuSE