Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-15079 (GCVE-0-2025-15079)
Vulnerability from cvelistv5 – Published: 2026-01-08 10:08 – Updated: 2026-01-08 14:46
VLAI?
EPSS
Title
libssh global known_hosts override
Summary
When doing SSH-based transfers using either SCP or SFTP, and setting the
known_hosts file, libcurl could still mistakenly accept connecting to hosts
*not present* in the specified file if they were added as recognized in the
libssh *global* known_hosts file.
Severity ?
5.3 (Medium)
Assigner
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| curl | curl |
Affected:
8.17.0 , ≤ 8.17.0
(semver)
Affected: 8.16.0 , ≤ 8.16.0 (semver) Affected: 8.15.0 , ≤ 8.15.0 (semver) Affected: 8.14.1 , ≤ 8.14.1 (semver) Affected: 8.14.0 , ≤ 8.14.0 (semver) Affected: 8.13.0 , ≤ 8.13.0 (semver) Affected: 8.12.1 , ≤ 8.12.1 (semver) Affected: 8.12.0 , ≤ 8.12.0 (semver) Affected: 8.11.1 , ≤ 8.11.1 (semver) Affected: 8.11.0 , ≤ 8.11.0 (semver) Affected: 8.10.1 , ≤ 8.10.1 (semver) Affected: 8.10.0 , ≤ 8.10.0 (semver) Affected: 8.9.1 , ≤ 8.9.1 (semver) Affected: 8.9.0 , ≤ 8.9.0 (semver) Affected: 8.8.0 , ≤ 8.8.0 (semver) Affected: 8.7.1 , ≤ 8.7.1 (semver) Affected: 8.7.0 , ≤ 8.7.0 (semver) Affected: 8.6.0 , ≤ 8.6.0 (semver) Affected: 8.5.0 , ≤ 8.5.0 (semver) Affected: 8.4.0 , ≤ 8.4.0 (semver) Affected: 8.3.0 , ≤ 8.3.0 (semver) Affected: 8.2.1 , ≤ 8.2.1 (semver) Affected: 8.2.0 , ≤ 8.2.0 (semver) Affected: 8.1.2 , ≤ 8.1.2 (semver) Affected: 8.1.1 , ≤ 8.1.1 (semver) Affected: 8.1.0 , ≤ 8.1.0 (semver) Affected: 8.0.1 , ≤ 8.0.1 (semver) Affected: 8.0.0 , ≤ 8.0.0 (semver) Affected: 7.88.1 , ≤ 7.88.1 (semver) Affected: 7.88.0 , ≤ 7.88.0 (semver) Affected: 7.87.0 , ≤ 7.87.0 (semver) Affected: 7.86.0 , ≤ 7.86.0 (semver) Affected: 7.85.0 , ≤ 7.85.0 (semver) Affected: 7.84.0 , ≤ 7.84.0 (semver) Affected: 7.83.1 , ≤ 7.83.1 (semver) Affected: 7.83.0 , ≤ 7.83.0 (semver) Affected: 7.82.0 , ≤ 7.82.0 (semver) Affected: 7.81.0 , ≤ 7.81.0 (semver) Affected: 7.80.0 , ≤ 7.80.0 (semver) Affected: 7.79.1 , ≤ 7.79.1 (semver) Affected: 7.79.0 , ≤ 7.79.0 (semver) Affected: 7.78.0 , ≤ 7.78.0 (semver) Affected: 7.77.0 , ≤ 7.77.0 (semver) Affected: 7.76.1 , ≤ 7.76.1 (semver) Affected: 7.76.0 , ≤ 7.76.0 (semver) Affected: 7.75.0 , ≤ 7.75.0 (semver) Affected: 7.74.0 , ≤ 7.74.0 (semver) Affected: 7.73.0 , ≤ 7.73.0 (semver) Affected: 7.72.0 , ≤ 7.72.0 (semver) Affected: 7.71.1 , ≤ 7.71.1 (semver) Affected: 7.71.0 , ≤ 7.71.0 (semver) Affected: 7.70.0 , ≤ 7.70.0 (semver) Affected: 7.69.1 , ≤ 7.69.1 (semver) Affected: 7.69.0 , ≤ 7.69.0 (semver) Affected: 7.68.0 , ≤ 7.68.0 (semver) Affected: 7.67.0 , ≤ 7.67.0 (semver) Affected: 7.66.0 , ≤ 7.66.0 (semver) Affected: 7.65.3 , ≤ 7.65.3 (semver) Affected: 7.65.2 , ≤ 7.65.2 (semver) Affected: 7.65.1 , ≤ 7.65.1 (semver) Affected: 7.65.0 , ≤ 7.65.0 (semver) Affected: 7.64.1 , ≤ 7.64.1 (semver) Affected: 7.64.0 , ≤ 7.64.0 (semver) Affected: 7.63.0 , ≤ 7.63.0 (semver) Affected: 7.62.0 , ≤ 7.62.0 (semver) Affected: 7.61.1 , ≤ 7.61.1 (semver) Affected: 7.61.0 , ≤ 7.61.0 (semver) Affected: 7.60.0 , ≤ 7.60.0 (semver) Affected: 7.59.0 , ≤ 7.59.0 (semver) Affected: 7.58.0 , ≤ 7.58.0 (semver) |
Credits
Harry Sintonen
Daniel Stenberg
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-01-08T11:06:21.628Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/01/07/6"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-15079",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-01-08T14:45:34.542278Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-297",
"description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-08T14:46:47.042Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "curl",
"vendor": "curl",
"versions": [
{
"lessThanOrEqual": "8.17.0",
"status": "affected",
"version": "8.17.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.16.0",
"status": "affected",
"version": "8.16.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.15.0",
"status": "affected",
"version": "8.15.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.14.1",
"status": "affected",
"version": "8.14.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.14.0",
"status": "affected",
"version": "8.14.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.13.0",
"status": "affected",
"version": "8.13.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.1",
"status": "affected",
"version": "8.12.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.12.0",
"status": "affected",
"version": "8.12.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.11.1",
"status": "affected",
"version": "8.11.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.11.0",
"status": "affected",
"version": "8.11.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.1",
"status": "affected",
"version": "8.10.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.10.0",
"status": "affected",
"version": "8.10.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.9.1",
"status": "affected",
"version": "8.9.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.9.0",
"status": "affected",
"version": "8.9.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.8.0",
"status": "affected",
"version": "8.8.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.7.1",
"status": "affected",
"version": "8.7.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.7.0",
"status": "affected",
"version": "8.7.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.6.0",
"status": "affected",
"version": "8.6.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.5.0",
"status": "affected",
"version": "8.5.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.4.0",
"status": "affected",
"version": "8.4.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.3.0",
"status": "affected",
"version": "8.3.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.2.1",
"status": "affected",
"version": "8.2.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.2.0",
"status": "affected",
"version": "8.2.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.1.2",
"status": "affected",
"version": "8.1.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.1.1",
"status": "affected",
"version": "8.1.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.1.0",
"status": "affected",
"version": "8.1.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.0.1",
"status": "affected",
"version": "8.0.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "8.0.0",
"status": "affected",
"version": "8.0.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.88.1",
"status": "affected",
"version": "7.88.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.88.0",
"status": "affected",
"version": "7.88.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.87.0",
"status": "affected",
"version": "7.87.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.86.0",
"status": "affected",
"version": "7.86.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.85.0",
"status": "affected",
"version": "7.85.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.84.0",
"status": "affected",
"version": "7.84.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.83.1",
"status": "affected",
"version": "7.83.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.83.0",
"status": "affected",
"version": "7.83.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.82.0",
"status": "affected",
"version": "7.82.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.81.0",
"status": "affected",
"version": "7.81.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.80.0",
"status": "affected",
"version": "7.80.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.79.1",
"status": "affected",
"version": "7.79.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.79.0",
"status": "affected",
"version": "7.79.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.78.0",
"status": "affected",
"version": "7.78.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.77.0",
"status": "affected",
"version": "7.77.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.76.1",
"status": "affected",
"version": "7.76.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.76.0",
"status": "affected",
"version": "7.76.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.75.0",
"status": "affected",
"version": "7.75.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.74.0",
"status": "affected",
"version": "7.74.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.73.0",
"status": "affected",
"version": "7.73.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.72.0",
"status": "affected",
"version": "7.72.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.71.1",
"status": "affected",
"version": "7.71.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.71.0",
"status": "affected",
"version": "7.71.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.70.0",
"status": "affected",
"version": "7.70.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.69.1",
"status": "affected",
"version": "7.69.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.69.0",
"status": "affected",
"version": "7.69.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.68.0",
"status": "affected",
"version": "7.68.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.67.0",
"status": "affected",
"version": "7.67.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.66.0",
"status": "affected",
"version": "7.66.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.65.3",
"status": "affected",
"version": "7.65.3",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.65.2",
"status": "affected",
"version": "7.65.2",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.65.1",
"status": "affected",
"version": "7.65.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.65.0",
"status": "affected",
"version": "7.65.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.64.1",
"status": "affected",
"version": "7.64.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.64.0",
"status": "affected",
"version": "7.64.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.63.0",
"status": "affected",
"version": "7.63.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.62.0",
"status": "affected",
"version": "7.62.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.61.1",
"status": "affected",
"version": "7.61.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.61.0",
"status": "affected",
"version": "7.61.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.60.0",
"status": "affected",
"version": "7.60.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.59.0",
"status": "affected",
"version": "7.59.0",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.58.0",
"status": "affected",
"version": "7.58.0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Harry Sintonen"
},
{
"lang": "en",
"type": "remediation developer",
"value": "Daniel Stenberg"
}
],
"descriptions": [
{
"lang": "en",
"value": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-297 Improper Validation of Certificate with Host Mismatch",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-08T10:08:13.410Z",
"orgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"shortName": "curl"
},
"references": [
{
"name": "json",
"url": "https://curl.se/docs/CVE-2025-15079.json"
},
{
"name": "www",
"url": "https://curl.se/docs/CVE-2025-15079.html"
},
{
"name": "issue",
"url": "https://hackerone.com/reports/3477116"
}
],
"title": "libssh global known_hosts override"
}
},
"cveMetadata": {
"assignerOrgId": "2499f714-1537-4658-8207-48ae4bb9eae9",
"assignerShortName": "curl",
"cveId": "CVE-2025-15079",
"datePublished": "2026-01-08T10:08:13.410Z",
"dateReserved": "2025-12-24T22:18:18.481Z",
"dateUpdated": "2026-01-08T14:46:47.042Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-15079\",\"sourceIdentifier\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"published\":\"2026-01-08T10:15:47.100\",\"lastModified\":\"2026-01-20T14:50:24.330\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"When doing SSH-based transfers using either SCP or SFTP, and setting the\\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\\n*not present* in the specified file if they were added as recognized in the\\nlibssh *global* known_hosts file.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-297\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.58.0\",\"versionEndExcluding\":\"8.18.0\",\"matchCriteriaId\":\"7FEF1B43-51CF-47FA-8D6C-2411D9B3F9C1\"}]}]}],\"references\":[{\"url\":\"https://curl.se/docs/CVE-2025-15079.html\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Vendor Advisory\",\"Patch\"]},{\"url\":\"https://curl.se/docs/CVE-2025-15079.json\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://hackerone.com/reports/3477116\",\"source\":\"2499f714-1537-4658-8207-48ae4bb9eae9\",\"tags\":[\"Exploit\",\"Issue Tracking\",\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/01/07/6\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\",\"Patch\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/01/07/6\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-01-08T11:06:21.628Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-15079\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-01-08T14:45:34.542278Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-297\", \"description\": \"CWE-297 Improper Validation of Certificate with Host Mismatch\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-01-08T14:45:56.225Z\"}}], \"cna\": {\"title\": \"libssh global known_hosts override\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Harry Sintonen\"}, {\"lang\": \"en\", \"type\": \"remediation developer\", \"value\": \"Daniel Stenberg\"}], \"affected\": [{\"vendor\": \"curl\", \"product\": \"curl\", \"versions\": [{\"status\": \"affected\", \"version\": \"8.17.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.17.0\"}, {\"status\": \"affected\", \"version\": \"8.16.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.16.0\"}, {\"status\": \"affected\", \"version\": \"8.15.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.15.0\"}, {\"status\": \"affected\", \"version\": \"8.14.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.14.1\"}, {\"status\": \"affected\", \"version\": \"8.14.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.14.0\"}, {\"status\": \"affected\", \"version\": \"8.13.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.13.0\"}, {\"status\": \"affected\", \"version\": \"8.12.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.12.1\"}, {\"status\": \"affected\", \"version\": \"8.12.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.12.0\"}, {\"status\": \"affected\", \"version\": \"8.11.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.11.1\"}, {\"status\": \"affected\", \"version\": \"8.11.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.11.0\"}, {\"status\": \"affected\", \"version\": \"8.10.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.10.1\"}, {\"status\": \"affected\", \"version\": \"8.10.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.10.0\"}, {\"status\": \"affected\", \"version\": \"8.9.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.9.1\"}, {\"status\": \"affected\", \"version\": \"8.9.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.9.0\"}, {\"status\": \"affected\", \"version\": \"8.8.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.8.0\"}, {\"status\": \"affected\", \"version\": \"8.7.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.7.1\"}, {\"status\": \"affected\", \"version\": \"8.7.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.7.0\"}, {\"status\": \"affected\", \"version\": \"8.6.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.6.0\"}, {\"status\": \"affected\", \"version\": \"8.5.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.5.0\"}, {\"status\": \"affected\", \"version\": \"8.4.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.4.0\"}, {\"status\": \"affected\", \"version\": \"8.3.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.3.0\"}, {\"status\": \"affected\", \"version\": \"8.2.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.2.1\"}, {\"status\": \"affected\", \"version\": \"8.2.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.2.0\"}, {\"status\": \"affected\", \"version\": \"8.1.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.2\"}, {\"status\": \"affected\", \"version\": \"8.1.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.1\"}, {\"status\": \"affected\", \"version\": \"8.1.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.1.0\"}, {\"status\": \"affected\", \"version\": \"8.0.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.0.1\"}, {\"status\": \"affected\", \"version\": \"8.0.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"8.0.0\"}, {\"status\": \"affected\", \"version\": \"7.88.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.88.1\"}, {\"status\": \"affected\", \"version\": \"7.88.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.88.0\"}, {\"status\": \"affected\", \"version\": \"7.87.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.87.0\"}, {\"status\": \"affected\", \"version\": \"7.86.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.86.0\"}, {\"status\": \"affected\", \"version\": \"7.85.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.85.0\"}, {\"status\": \"affected\", \"version\": \"7.84.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.84.0\"}, {\"status\": \"affected\", \"version\": \"7.83.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.83.1\"}, {\"status\": \"affected\", \"version\": \"7.83.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.83.0\"}, {\"status\": \"affected\", \"version\": \"7.82.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.82.0\"}, {\"status\": \"affected\", \"version\": \"7.81.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.81.0\"}, {\"status\": \"affected\", \"version\": \"7.80.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.80.0\"}, {\"status\": \"affected\", \"version\": \"7.79.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.79.1\"}, {\"status\": \"affected\", \"version\": \"7.79.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.79.0\"}, {\"status\": \"affected\", \"version\": \"7.78.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.78.0\"}, {\"status\": \"affected\", \"version\": \"7.77.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.77.0\"}, {\"status\": \"affected\", \"version\": \"7.76.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.76.1\"}, {\"status\": \"affected\", \"version\": \"7.76.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.76.0\"}, {\"status\": \"affected\", \"version\": \"7.75.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.75.0\"}, {\"status\": \"affected\", \"version\": \"7.74.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.74.0\"}, {\"status\": \"affected\", \"version\": \"7.73.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.73.0\"}, {\"status\": \"affected\", \"version\": \"7.72.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.72.0\"}, {\"status\": \"affected\", \"version\": \"7.71.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.71.1\"}, {\"status\": \"affected\", \"version\": \"7.71.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.71.0\"}, {\"status\": \"affected\", \"version\": \"7.70.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.70.0\"}, {\"status\": \"affected\", \"version\": \"7.69.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.69.1\"}, {\"status\": \"affected\", \"version\": \"7.69.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.69.0\"}, {\"status\": \"affected\", \"version\": \"7.68.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.68.0\"}, {\"status\": \"affected\", \"version\": \"7.67.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.67.0\"}, {\"status\": \"affected\", \"version\": \"7.66.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.66.0\"}, {\"status\": \"affected\", \"version\": \"7.65.3\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.3\"}, {\"status\": \"affected\", \"version\": \"7.65.2\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.2\"}, {\"status\": \"affected\", \"version\": \"7.65.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.1\"}, {\"status\": \"affected\", \"version\": \"7.65.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.65.0\"}, {\"status\": \"affected\", \"version\": \"7.64.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.64.1\"}, {\"status\": \"affected\", \"version\": \"7.64.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.64.0\"}, {\"status\": \"affected\", \"version\": \"7.63.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.63.0\"}, {\"status\": \"affected\", \"version\": \"7.62.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.62.0\"}, {\"status\": \"affected\", \"version\": \"7.61.1\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.61.1\"}, {\"status\": \"affected\", \"version\": \"7.61.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.61.0\"}, {\"status\": \"affected\", \"version\": \"7.60.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.60.0\"}, {\"status\": \"affected\", \"version\": \"7.59.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.59.0\"}, {\"status\": \"affected\", \"version\": \"7.58.0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.58.0\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://curl.se/docs/CVE-2025-15079.json\", \"name\": \"json\"}, {\"url\": \"https://curl.se/docs/CVE-2025-15079.html\", \"name\": \"www\"}, {\"url\": \"https://hackerone.com/reports/3477116\", \"name\": \"issue\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"When doing SSH-based transfers using either SCP or SFTP, and setting the\\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\\n*not present* in the specified file if they were added as recognized in the\\nlibssh *global* known_hosts file.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-297 Improper Validation of Certificate with Host Mismatch\"}]}], \"providerMetadata\": {\"orgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"shortName\": \"curl\", \"dateUpdated\": \"2026-01-08T10:08:13.410Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-15079\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-01-08T14:46:47.042Z\", \"dateReserved\": \"2025-12-24T22:18:18.481Z\", \"assignerOrgId\": \"2499f714-1537-4658-8207-48ae4bb9eae9\", \"datePublished\": \"2026-01-08T10:08:13.410Z\", \"assignerShortName\": \"curl\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
SUSE-SU-2026:0051-1
Vulnerability from csaf_suse - Published: 2026-01-07 09:28 - Updated: 2026-01-07 09:28Summary
Security update for curl
Notes
Title of the patch
Security update for curl
Description of the patch
This update for curl fixes the following issues:
- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
- CVE-2025-14819: libssh global knownhost override (bsc#1255732).
- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).
Patchnames
SUSE-2026-51,SUSE-SUSE-MicroOS-5.2-2026-51
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for curl",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-51,SUSE-SUSE-MicroOS-5.2-2026-51",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0051-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:0051-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260051-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:0051-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023697.html"
},
{
"category": "self",
"summary": "SUSE Bug 1255731",
"url": "https://bugzilla.suse.com/1255731"
},
{
"category": "self",
"summary": "SUSE Bug 1255732",
"url": "https://bugzilla.suse.com/1255732"
},
{
"category": "self",
"summary": "SUSE Bug 1255733",
"url": "https://bugzilla.suse.com/1255733"
},
{
"category": "self",
"summary": "SUSE Bug 1255734",
"url": "https://bugzilla.suse.com/1255734"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14524 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14524/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14819 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15079 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15224 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15224/"
}
],
"title": "Security update for curl",
"tracking": {
"current_release_date": "2026-01-07T09:28:27Z",
"generator": {
"date": "2026-01-07T09:28:27Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:0051-1",
"initial_release_date": "2026-01-07T09:28:27Z",
"revision_history": [
{
"date": "2026-01-07T09:28:27Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150200.4.97.1.aarch64",
"product": {
"name": "curl-8.14.1-150200.4.97.1.aarch64",
"product_id": "curl-8.14.1-150200.4.97.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150200.4.97.1.aarch64",
"product": {
"name": "libcurl-devel-8.14.1-150200.4.97.1.aarch64",
"product_id": "libcurl-devel-8.14.1-150200.4.97.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150200.4.97.1.aarch64",
"product": {
"name": "libcurl-mini4-8.14.1-150200.4.97.1.aarch64",
"product_id": "libcurl-mini4-8.14.1-150200.4.97.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150200.4.97.1.aarch64",
"product": {
"name": "libcurl4-8.14.1-150200.4.97.1.aarch64",
"product_id": "libcurl4-8.14.1-150200.4.97.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libcurl-devel-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
"product": {
"name": "libcurl-devel-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
"product_id": "libcurl-devel-64bit-8.14.1-150200.4.97.1.aarch64_ilp32"
}
},
{
"category": "product_version",
"name": "libcurl4-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
"product": {
"name": "libcurl4-64bit-8.14.1-150200.4.97.1.aarch64_ilp32",
"product_id": "libcurl4-64bit-8.14.1-150200.4.97.1.aarch64_ilp32"
}
}
],
"category": "architecture",
"name": "aarch64_ilp32"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150200.4.97.1.i586",
"product": {
"name": "curl-8.14.1-150200.4.97.1.i586",
"product_id": "curl-8.14.1-150200.4.97.1.i586"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150200.4.97.1.i586",
"product": {
"name": "libcurl-devel-8.14.1-150200.4.97.1.i586",
"product_id": "libcurl-devel-8.14.1-150200.4.97.1.i586"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150200.4.97.1.i586",
"product": {
"name": "libcurl-mini4-8.14.1-150200.4.97.1.i586",
"product_id": "libcurl-mini4-8.14.1-150200.4.97.1.i586"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150200.4.97.1.i586",
"product": {
"name": "libcurl4-8.14.1-150200.4.97.1.i586",
"product_id": "libcurl4-8.14.1-150200.4.97.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-fish-completion-8.14.1-150200.4.97.1.noarch",
"product": {
"name": "curl-fish-completion-8.14.1-150200.4.97.1.noarch",
"product_id": "curl-fish-completion-8.14.1-150200.4.97.1.noarch"
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.14.1-150200.4.97.1.noarch",
"product": {
"name": "curl-zsh-completion-8.14.1-150200.4.97.1.noarch",
"product_id": "curl-zsh-completion-8.14.1-150200.4.97.1.noarch"
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.14.1-150200.4.97.1.noarch",
"product": {
"name": "libcurl-devel-doc-8.14.1-150200.4.97.1.noarch",
"product_id": "libcurl-devel-doc-8.14.1-150200.4.97.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150200.4.97.1.ppc64le",
"product": {
"name": "curl-8.14.1-150200.4.97.1.ppc64le",
"product_id": "curl-8.14.1-150200.4.97.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150200.4.97.1.ppc64le",
"product": {
"name": "libcurl-devel-8.14.1-150200.4.97.1.ppc64le",
"product_id": "libcurl-devel-8.14.1-150200.4.97.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150200.4.97.1.ppc64le",
"product": {
"name": "libcurl-mini4-8.14.1-150200.4.97.1.ppc64le",
"product_id": "libcurl-mini4-8.14.1-150200.4.97.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150200.4.97.1.ppc64le",
"product": {
"name": "libcurl4-8.14.1-150200.4.97.1.ppc64le",
"product_id": "libcurl4-8.14.1-150200.4.97.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150200.4.97.1.s390x",
"product": {
"name": "curl-8.14.1-150200.4.97.1.s390x",
"product_id": "curl-8.14.1-150200.4.97.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150200.4.97.1.s390x",
"product": {
"name": "libcurl-devel-8.14.1-150200.4.97.1.s390x",
"product_id": "libcurl-devel-8.14.1-150200.4.97.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150200.4.97.1.s390x",
"product": {
"name": "libcurl-mini4-8.14.1-150200.4.97.1.s390x",
"product_id": "libcurl-mini4-8.14.1-150200.4.97.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150200.4.97.1.s390x",
"product": {
"name": "libcurl4-8.14.1-150200.4.97.1.s390x",
"product_id": "libcurl4-8.14.1-150200.4.97.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150200.4.97.1.x86_64",
"product": {
"name": "curl-8.14.1-150200.4.97.1.x86_64",
"product_id": "curl-8.14.1-150200.4.97.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150200.4.97.1.x86_64",
"product": {
"name": "libcurl-devel-8.14.1-150200.4.97.1.x86_64",
"product_id": "libcurl-devel-8.14.1-150200.4.97.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.14.1-150200.4.97.1.x86_64",
"product": {
"name": "libcurl-devel-32bit-8.14.1-150200.4.97.1.x86_64",
"product_id": "libcurl-devel-32bit-8.14.1-150200.4.97.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150200.4.97.1.x86_64",
"product": {
"name": "libcurl-mini4-8.14.1-150200.4.97.1.x86_64",
"product_id": "libcurl-mini4-8.14.1-150200.4.97.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150200.4.97.1.x86_64",
"product": {
"name": "libcurl4-8.14.1-150200.4.97.1.x86_64",
"product_id": "libcurl4-8.14.1-150200.4.97.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.14.1-150200.4.97.1.x86_64",
"product": {
"name": "libcurl4-32bit-8.14.1-150200.4.97.1.x86_64",
"product_id": "libcurl4-32bit-8.14.1-150200.4.97.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.2",
"product": {
"name": "SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-microos:5.2"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-150200.4.97.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64"
},
"product_reference": "curl-8.14.1-150200.4.97.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-150200.4.97.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x"
},
"product_reference": "curl-8.14.1-150200.4.97.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-150200.4.97.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64"
},
"product_reference": "curl-8.14.1-150200.4.97.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-150200.4.97.1.aarch64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64"
},
"product_reference": "libcurl4-8.14.1-150200.4.97.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-150200.4.97.1.s390x as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x"
},
"product_reference": "libcurl4-8.14.1-150200.4.97.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-150200.4.97.1.x86_64 as component of SUSE Linux Enterprise Micro 5.2",
"product_id": "SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
},
"product_reference": "libcurl4-8.14.1-150200.4.97.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14524",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14524"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14524",
"url": "https://www.suse.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "SUSE Bug 1255731 for CVE-2025-14524",
"url": "https://bugzilla.suse.com/1255731"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:27Z",
"details": "moderate"
}
],
"title": "CVE-2025-14524"
},
{
"cve": "CVE-2025-14819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14819"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14819",
"url": "https://www.suse.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "SUSE Bug 1255732 for CVE-2025-14819",
"url": "https://bugzilla.suse.com/1255732"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:27Z",
"details": "moderate"
}
],
"title": "CVE-2025-14819"
},
{
"cve": "CVE-2025-15079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15079"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15079",
"url": "https://www.suse.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "SUSE Bug 1255733 for CVE-2025-15079",
"url": "https://bugzilla.suse.com/1255733"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:27Z",
"details": "moderate"
}
],
"title": "CVE-2025-15079"
},
{
"cve": "CVE-2025-15224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15224"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15224",
"url": "https://www.suse.com/security/cve/CVE-2025-15224"
},
{
"category": "external",
"summary": "SUSE Bug 1255734 for CVE-2025-15224",
"url": "https://bugzilla.suse.com/1255734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:curl-8.14.1-150200.4.97.1.x86_64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.aarch64",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.s390x",
"SUSE Linux Enterprise Micro 5.2:libcurl4-8.14.1-150200.4.97.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:27Z",
"details": "moderate"
}
],
"title": "CVE-2025-15224"
}
]
}
SUSE-SU-2026:20062-1
Vulnerability from csaf_suse - Published: 2026-01-08 14:51 - Updated: 2026-01-08 14:51Summary
Security update for curl
Notes
Title of the patch
Security update for curl
Description of the patch
This update for curl fixes the following issues:
- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
- CVE-2025-14819: libssh global knownhost override (bsc#1255732).
- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).
Patchnames
SUSE-SLE-Micro-6.1-368
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for curl",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-368",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20062-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:20062-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620062-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:20062-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023749.html"
},
{
"category": "self",
"summary": "SUSE Bug 1255731",
"url": "https://bugzilla.suse.com/1255731"
},
{
"category": "self",
"summary": "SUSE Bug 1255732",
"url": "https://bugzilla.suse.com/1255732"
},
{
"category": "self",
"summary": "SUSE Bug 1255733",
"url": "https://bugzilla.suse.com/1255733"
},
{
"category": "self",
"summary": "SUSE Bug 1255734",
"url": "https://bugzilla.suse.com/1255734"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14524 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14524/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14819 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15079 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15224 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15224/"
}
],
"title": "Security update for curl",
"tracking": {
"current_release_date": "2026-01-08T14:51:21Z",
"generator": {
"date": "2026-01-08T14:51:21Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:20062-1",
"initial_release_date": "2026-01-08T14:51:21Z",
"revision_history": [
{
"date": "2026-01-08T14:51:21Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-slfo.1.1_4.1.aarch64",
"product": {
"name": "curl-8.14.1-slfo.1.1_4.1.aarch64",
"product_id": "curl-8.14.1-slfo.1.1_4.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"product": {
"name": "libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"product_id": "libcurl4-8.14.1-slfo.1.1_4.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-slfo.1.1_4.1.ppc64le",
"product": {
"name": "curl-8.14.1-slfo.1.1_4.1.ppc64le",
"product_id": "curl-8.14.1-slfo.1.1_4.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"product": {
"name": "libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"product_id": "libcurl4-8.14.1-slfo.1.1_4.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-slfo.1.1_4.1.s390x",
"product": {
"name": "curl-8.14.1-slfo.1.1_4.1.s390x",
"product_id": "curl-8.14.1-slfo.1.1_4.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"product": {
"name": "libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"product_id": "libcurl4-8.14.1-slfo.1.1_4.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-slfo.1.1_4.1.x86_64",
"product": {
"name": "curl-8.14.1-slfo.1.1_4.1.x86_64",
"product_id": "curl-8.14.1-slfo.1.1_4.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-slfo.1.1_4.1.x86_64",
"product": {
"name": "libcurl4-8.14.1-slfo.1.1_4.1.x86_64",
"product_id": "libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-slfo.1.1_4.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64"
},
"product_reference": "curl-8.14.1-slfo.1.1_4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-slfo.1.1_4.1.ppc64le as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le"
},
"product_reference": "curl-8.14.1-slfo.1.1_4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-slfo.1.1_4.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x"
},
"product_reference": "curl-8.14.1-slfo.1.1_4.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-slfo.1.1_4.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64"
},
"product_reference": "curl-8.14.1-slfo.1.1_4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-slfo.1.1_4.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64"
},
"product_reference": "libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-slfo.1.1_4.1.ppc64le as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le"
},
"product_reference": "libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-slfo.1.1_4.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x"
},
"product_reference": "libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-slfo.1.1_4.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
},
"product_reference": "libcurl4-8.14.1-slfo.1.1_4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14524",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14524"
}
],
"notes": [
{
"category": "general",
"text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14524",
"url": "https://www.suse.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "SUSE Bug 1255731 for CVE-2025-14524",
"url": "https://bugzilla.suse.com/1255731"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T14:51:21Z",
"details": "moderate"
}
],
"title": "CVE-2025-14524"
},
{
"cve": "CVE-2025-14819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14819"
}
],
"notes": [
{
"category": "general",
"text": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14819",
"url": "https://www.suse.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "SUSE Bug 1255732 for CVE-2025-14819",
"url": "https://bugzilla.suse.com/1255732"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T14:51:21Z",
"details": "moderate"
}
],
"title": "CVE-2025-14819"
},
{
"cve": "CVE-2025-15079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15079"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15079",
"url": "https://www.suse.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "SUSE Bug 1255733 for CVE-2025-15079",
"url": "https://bugzilla.suse.com/1255733"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T14:51:21Z",
"details": "moderate"
}
],
"title": "CVE-2025-15079"
},
{
"cve": "CVE-2025-15224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15224"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15224",
"url": "https://www.suse.com/security/cve/CVE-2025-15224"
},
{
"category": "external",
"summary": "SUSE Bug 1255734 for CVE-2025-15224",
"url": "https://bugzilla.suse.com/1255734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:curl-8.14.1-slfo.1.1_4.1.x86_64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.aarch64",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.ppc64le",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.s390x",
"SUSE Linux Micro 6.1:libcurl4-8.14.1-slfo.1.1_4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T14:51:21Z",
"details": "moderate"
}
],
"title": "CVE-2025-15224"
}
]
}
SUSE-SU-2026:0050-1
Vulnerability from csaf_suse - Published: 2026-01-07 09:28 - Updated: 2026-01-07 09:28Summary
Security update for curl
Notes
Title of the patch
Security update for curl
Description of the patch
This update for curl fixes the following issues:
- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
- CVE-2025-14819: libssh global knownhost override (bsc#1255732).
- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).
Patchnames
SUSE-2026-50,openSUSE-SLE-15.6-2026-50
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for curl",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-50,openSUSE-SLE-15.6-2026-50",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0050-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:0050-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260050-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:0050-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023698.html"
},
{
"category": "self",
"summary": "SUSE Bug 1255731",
"url": "https://bugzilla.suse.com/1255731"
},
{
"category": "self",
"summary": "SUSE Bug 1255732",
"url": "https://bugzilla.suse.com/1255732"
},
{
"category": "self",
"summary": "SUSE Bug 1255733",
"url": "https://bugzilla.suse.com/1255733"
},
{
"category": "self",
"summary": "SUSE Bug 1255734",
"url": "https://bugzilla.suse.com/1255734"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14524 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14524/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14819 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15079 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15224 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15224/"
}
],
"title": "Security update for curl",
"tracking": {
"current_release_date": "2026-01-07T09:28:15Z",
"generator": {
"date": "2026-01-07T09:28:15Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:0050-1",
"initial_release_date": "2026-01-07T09:28:15Z",
"revision_history": [
{
"date": "2026-01-07T09:28:15Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150600.4.34.1.aarch64",
"product": {
"name": "curl-8.14.1-150600.4.34.1.aarch64",
"product_id": "curl-8.14.1-150600.4.34.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"product": {
"name": "libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"product_id": "libcurl-devel-8.14.1-150600.4.34.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150600.4.34.1.aarch64",
"product": {
"name": "libcurl-mini4-8.14.1-150600.4.34.1.aarch64",
"product_id": "libcurl-mini4-8.14.1-150600.4.34.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150600.4.34.1.aarch64",
"product": {
"name": "libcurl4-8.14.1-150600.4.34.1.aarch64",
"product_id": "libcurl4-8.14.1-150600.4.34.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libcurl-devel-64bit-8.14.1-150600.4.34.1.aarch64_ilp32",
"product": {
"name": "libcurl-devel-64bit-8.14.1-150600.4.34.1.aarch64_ilp32",
"product_id": "libcurl-devel-64bit-8.14.1-150600.4.34.1.aarch64_ilp32"
}
},
{
"category": "product_version",
"name": "libcurl4-64bit-8.14.1-150600.4.34.1.aarch64_ilp32",
"product": {
"name": "libcurl4-64bit-8.14.1-150600.4.34.1.aarch64_ilp32",
"product_id": "libcurl4-64bit-8.14.1-150600.4.34.1.aarch64_ilp32"
}
}
],
"category": "architecture",
"name": "aarch64_ilp32"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150600.4.34.1.i586",
"product": {
"name": "curl-8.14.1-150600.4.34.1.i586",
"product_id": "curl-8.14.1-150600.4.34.1.i586"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150600.4.34.1.i586",
"product": {
"name": "libcurl-devel-8.14.1-150600.4.34.1.i586",
"product_id": "libcurl-devel-8.14.1-150600.4.34.1.i586"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150600.4.34.1.i586",
"product": {
"name": "libcurl-mini4-8.14.1-150600.4.34.1.i586",
"product_id": "libcurl-mini4-8.14.1-150600.4.34.1.i586"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150600.4.34.1.i586",
"product": {
"name": "libcurl4-8.14.1-150600.4.34.1.i586",
"product_id": "libcurl4-8.14.1-150600.4.34.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-fish-completion-8.14.1-150600.4.34.1.noarch",
"product": {
"name": "curl-fish-completion-8.14.1-150600.4.34.1.noarch",
"product_id": "curl-fish-completion-8.14.1-150600.4.34.1.noarch"
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.14.1-150600.4.34.1.noarch",
"product": {
"name": "curl-zsh-completion-8.14.1-150600.4.34.1.noarch",
"product_id": "curl-zsh-completion-8.14.1-150600.4.34.1.noarch"
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.14.1-150600.4.34.1.noarch",
"product": {
"name": "libcurl-devel-doc-8.14.1-150600.4.34.1.noarch",
"product_id": "libcurl-devel-doc-8.14.1-150600.4.34.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150600.4.34.1.ppc64le",
"product": {
"name": "curl-8.14.1-150600.4.34.1.ppc64le",
"product_id": "curl-8.14.1-150600.4.34.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"product": {
"name": "libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"product_id": "libcurl-devel-8.14.1-150600.4.34.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150600.4.34.1.ppc64le",
"product": {
"name": "libcurl-mini4-8.14.1-150600.4.34.1.ppc64le",
"product_id": "libcurl-mini4-8.14.1-150600.4.34.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150600.4.34.1.ppc64le",
"product": {
"name": "libcurl4-8.14.1-150600.4.34.1.ppc64le",
"product_id": "libcurl4-8.14.1-150600.4.34.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150600.4.34.1.s390x",
"product": {
"name": "curl-8.14.1-150600.4.34.1.s390x",
"product_id": "curl-8.14.1-150600.4.34.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150600.4.34.1.s390x",
"product": {
"name": "libcurl-devel-8.14.1-150600.4.34.1.s390x",
"product_id": "libcurl-devel-8.14.1-150600.4.34.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150600.4.34.1.s390x",
"product": {
"name": "libcurl-mini4-8.14.1-150600.4.34.1.s390x",
"product_id": "libcurl-mini4-8.14.1-150600.4.34.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150600.4.34.1.s390x",
"product": {
"name": "libcurl4-8.14.1-150600.4.34.1.s390x",
"product_id": "libcurl4-8.14.1-150600.4.34.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150600.4.34.1.x86_64",
"product": {
"name": "curl-8.14.1-150600.4.34.1.x86_64",
"product_id": "curl-8.14.1-150600.4.34.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"product": {
"name": "libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"product_id": "libcurl-devel-8.14.1-150600.4.34.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"product": {
"name": "libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"product_id": "libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150600.4.34.1.x86_64",
"product": {
"name": "libcurl-mini4-8.14.1-150600.4.34.1.x86_64",
"product_id": "libcurl-mini4-8.14.1-150600.4.34.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150600.4.34.1.x86_64",
"product": {
"name": "libcurl4-8.14.1-150600.4.34.1.x86_64",
"product_id": "libcurl4-8.14.1-150600.4.34.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"product": {
"name": "libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"product_id": "libcurl4-32bit-8.14.1-150600.4.34.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-150600.4.34.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64"
},
"product_reference": "curl-8.14.1-150600.4.34.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-150600.4.34.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le"
},
"product_reference": "curl-8.14.1-150600.4.34.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-150600.4.34.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x"
},
"product_reference": "curl-8.14.1-150600.4.34.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-150600.4.34.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64"
},
"product_reference": "curl-8.14.1-150600.4.34.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-150600.4.34.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64"
},
"product_reference": "libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-150600.4.34.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le"
},
"product_reference": "libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-150600.4.34.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x"
},
"product_reference": "libcurl-devel-8.14.1-150600.4.34.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-150600.4.34.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64"
},
"product_reference": "libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64"
},
"product_reference": "libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-150600.4.34.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64"
},
"product_reference": "libcurl4-8.14.1-150600.4.34.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-150600.4.34.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le"
},
"product_reference": "libcurl4-8.14.1-150600.4.34.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-150600.4.34.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x"
},
"product_reference": "libcurl4-8.14.1-150600.4.34.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-150600.4.34.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
},
"product_reference": "libcurl4-8.14.1-150600.4.34.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-8.14.1-150600.4.34.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64"
},
"product_reference": "libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14524",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14524"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14524",
"url": "https://www.suse.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "SUSE Bug 1255731 for CVE-2025-14524",
"url": "https://bugzilla.suse.com/1255731"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:15Z",
"details": "moderate"
}
],
"title": "CVE-2025-14524"
},
{
"cve": "CVE-2025-14819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14819"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14819",
"url": "https://www.suse.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "SUSE Bug 1255732 for CVE-2025-14819",
"url": "https://bugzilla.suse.com/1255732"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:15Z",
"details": "moderate"
}
],
"title": "CVE-2025-14819"
},
{
"cve": "CVE-2025-15079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15079"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15079",
"url": "https://www.suse.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "SUSE Bug 1255733 for CVE-2025-15079",
"url": "https://bugzilla.suse.com/1255733"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:15Z",
"details": "moderate"
}
],
"title": "CVE-2025-15079"
},
{
"cve": "CVE-2025-15224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15224"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15224",
"url": "https://www.suse.com/security/cve/CVE-2025-15224"
},
{
"category": "external",
"summary": "SUSE Bug 1255734 for CVE-2025-15224",
"url": "https://bugzilla.suse.com/1255734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:curl-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl-devel-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-32bit-8.14.1-150600.4.34.1.x86_64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.aarch64",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.ppc64le",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.s390x",
"openSUSE Leap 15.6:libcurl4-8.14.1-150600.4.34.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:15Z",
"details": "moderate"
}
],
"title": "CVE-2025-15224"
}
]
}
SUSE-SU-2026:0066-1
Vulnerability from csaf_suse - Published: 2026-01-08 12:21 - Updated: 2026-01-08 12:21Summary
Security update for curl
Notes
Title of the patch
Security update for curl
Description of the patch
This update for curl fixes the following issues:
- CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect (bsc#1255731)
- CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile (bsc#1255733)
- CVE-2025-14819: Fixed issue where alteration of CURLSSLOPT_NO_PARTIALCHAIN could
accidentally lead to CA cache reuse for which partial chain was reversed (bsc#1255732)
Patchnames
SUSE-2026-66,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-66
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for curl",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for curl fixes the following issues:\n\n - CVE-2025-14524: Fixed bearer token leak on cross-protocol redirect (bsc#1255731)\n - CVE-2025-15079: Fixed unknown host connection acceptance when set in the global knownhostsfile (bsc#1255733)\n - CVE-2025-14819: Fixed issue where alteration of CURLSSLOPT_NO_PARTIALCHAIN could\n accidentally lead to CA cache reuse for which partial chain was reversed (bsc#1255732)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-66,SUSE-SLE-SERVER-12-SP5-LTSS-EXTENDED-SECURITY-2026-66",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0066-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:0066-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260066-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:0066-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023711.html"
},
{
"category": "self",
"summary": "SUSE Bug 1255731",
"url": "https://bugzilla.suse.com/1255731"
},
{
"category": "self",
"summary": "SUSE Bug 1255732",
"url": "https://bugzilla.suse.com/1255732"
},
{
"category": "self",
"summary": "SUSE Bug 1255733",
"url": "https://bugzilla.suse.com/1255733"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14524 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14524/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14819 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15079 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15079/"
}
],
"title": "Security update for curl",
"tracking": {
"current_release_date": "2026-01-08T12:21:35Z",
"generator": {
"date": "2026-01-08T12:21:35Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:0066-1",
"initial_release_date": "2026-01-08T12:21:35Z",
"revision_history": [
{
"date": "2026-01-08T12:21:35Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.0.1-11.111.1.aarch64",
"product": {
"name": "curl-8.0.1-11.111.1.aarch64",
"product_id": "curl-8.0.1-11.111.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.0.1-11.111.1.aarch64",
"product": {
"name": "libcurl-devel-8.0.1-11.111.1.aarch64",
"product_id": "libcurl-devel-8.0.1-11.111.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.0.1-11.111.1.aarch64",
"product": {
"name": "libcurl4-8.0.1-11.111.1.aarch64",
"product_id": "libcurl4-8.0.1-11.111.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libcurl-devel-64bit-8.0.1-11.111.1.aarch64_ilp32",
"product": {
"name": "libcurl-devel-64bit-8.0.1-11.111.1.aarch64_ilp32",
"product_id": "libcurl-devel-64bit-8.0.1-11.111.1.aarch64_ilp32"
}
},
{
"category": "product_version",
"name": "libcurl4-64bit-8.0.1-11.111.1.aarch64_ilp32",
"product": {
"name": "libcurl4-64bit-8.0.1-11.111.1.aarch64_ilp32",
"product_id": "libcurl4-64bit-8.0.1-11.111.1.aarch64_ilp32"
}
}
],
"category": "architecture",
"name": "aarch64_ilp32"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.0.1-11.111.1.i586",
"product": {
"name": "curl-8.0.1-11.111.1.i586",
"product_id": "curl-8.0.1-11.111.1.i586"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.0.1-11.111.1.i586",
"product": {
"name": "libcurl-devel-8.0.1-11.111.1.i586",
"product_id": "libcurl-devel-8.0.1-11.111.1.i586"
}
},
{
"category": "product_version",
"name": "libcurl4-8.0.1-11.111.1.i586",
"product": {
"name": "libcurl4-8.0.1-11.111.1.i586",
"product_id": "libcurl4-8.0.1-11.111.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.0.1-11.111.1.ppc64le",
"product": {
"name": "curl-8.0.1-11.111.1.ppc64le",
"product_id": "curl-8.0.1-11.111.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.0.1-11.111.1.ppc64le",
"product": {
"name": "libcurl-devel-8.0.1-11.111.1.ppc64le",
"product_id": "libcurl-devel-8.0.1-11.111.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl4-8.0.1-11.111.1.ppc64le",
"product": {
"name": "libcurl4-8.0.1-11.111.1.ppc64le",
"product_id": "libcurl4-8.0.1-11.111.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.0.1-11.111.1.s390",
"product": {
"name": "curl-8.0.1-11.111.1.s390",
"product_id": "curl-8.0.1-11.111.1.s390"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.0.1-11.111.1.s390",
"product": {
"name": "libcurl-devel-8.0.1-11.111.1.s390",
"product_id": "libcurl-devel-8.0.1-11.111.1.s390"
}
},
{
"category": "product_version",
"name": "libcurl4-8.0.1-11.111.1.s390",
"product": {
"name": "libcurl4-8.0.1-11.111.1.s390",
"product_id": "libcurl4-8.0.1-11.111.1.s390"
}
}
],
"category": "architecture",
"name": "s390"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.0.1-11.111.1.s390x",
"product": {
"name": "curl-8.0.1-11.111.1.s390x",
"product_id": "curl-8.0.1-11.111.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.0.1-11.111.1.s390x",
"product": {
"name": "libcurl-devel-8.0.1-11.111.1.s390x",
"product_id": "libcurl-devel-8.0.1-11.111.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.0.1-11.111.1.s390x",
"product": {
"name": "libcurl-devel-32bit-8.0.1-11.111.1.s390x",
"product_id": "libcurl-devel-32bit-8.0.1-11.111.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-8.0.1-11.111.1.s390x",
"product": {
"name": "libcurl4-8.0.1-11.111.1.s390x",
"product_id": "libcurl4-8.0.1-11.111.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.0.1-11.111.1.s390x",
"product": {
"name": "libcurl4-32bit-8.0.1-11.111.1.s390x",
"product_id": "libcurl4-32bit-8.0.1-11.111.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.0.1-11.111.1.x86_64",
"product": {
"name": "curl-8.0.1-11.111.1.x86_64",
"product_id": "curl-8.0.1-11.111.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.0.1-11.111.1.x86_64",
"product": {
"name": "libcurl-devel-8.0.1-11.111.1.x86_64",
"product_id": "libcurl-devel-8.0.1-11.111.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.0.1-11.111.1.x86_64",
"product": {
"name": "libcurl-devel-32bit-8.0.1-11.111.1.x86_64",
"product_id": "libcurl-devel-32bit-8.0.1-11.111.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.0.1-11.111.1.x86_64",
"product": {
"name": "libcurl4-8.0.1-11.111.1.x86_64",
"product_id": "libcurl4-8.0.1-11.111.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.0.1-11.111.1.x86_64",
"product": {
"name": "libcurl4-32bit-8.0.1-11.111.1.x86_64",
"product_id": "libcurl4-32bit-8.0.1-11.111.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product": {
"name": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles-ltss-extended-security:12:sp5"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64"
},
"product_reference": "curl-8.0.1-11.111.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64"
},
"product_reference": "libcurl-devel-8.0.1-11.111.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
},
"product_reference": "libcurl4-8.0.1-11.111.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-8.0.1-11.111.1.x86_64 as component of SUSE Linux Enterprise Server LTSS Extended Security 12 SP5",
"product_id": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64"
},
"product_reference": "libcurl4-32bit-8.0.1-11.111.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server LTSS Extended Security 12 SP5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14524",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14524"
}
],
"notes": [
{
"category": "general",
"text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14524",
"url": "https://www.suse.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "SUSE Bug 1255731 for CVE-2025-14524",
"url": "https://bugzilla.suse.com/1255731"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T12:21:35Z",
"details": "moderate"
}
],
"title": "CVE-2025-14524"
},
{
"cve": "CVE-2025-14819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14819"
}
],
"notes": [
{
"category": "general",
"text": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14819",
"url": "https://www.suse.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "SUSE Bug 1255732 for CVE-2025-14819",
"url": "https://bugzilla.suse.com/1255732"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T12:21:35Z",
"details": "moderate"
}
],
"title": "CVE-2025-14819"
},
{
"cve": "CVE-2025-15079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15079"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15079",
"url": "https://www.suse.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "SUSE Bug 1255733 for CVE-2025-15079",
"url": "https://bugzilla.suse.com/1255733"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:curl-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl-devel-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-32bit-8.0.1-11.111.1.x86_64",
"SUSE Linux Enterprise Server LTSS Extended Security 12 SP5:libcurl4-8.0.1-11.111.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T12:21:35Z",
"details": "moderate"
}
],
"title": "CVE-2025-15079"
}
]
}
SUSE-SU-2026:20110-1
Vulnerability from csaf_suse - Published: 2026-01-14 10:58 - Updated: 2026-01-14 10:58Summary
Security update for curl
Notes
Title of the patch
Security update for curl
Description of the patch
This update for curl fixes the following issues:
This update for curl fixes the following issues:
- CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).
- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
- CVE-2025-14819: libssh global knownhost override (bsc#1255732).
- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).
Patchnames
SUSE-SL-Micro-6.2-140
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for curl",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for curl fixes the following issues:\n\nThis update for curl fixes the following issues:\n\n- CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SL-Micro-6.2-140",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20110-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:20110-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620110-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:20110-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023878.html"
},
{
"category": "self",
"summary": "SUSE Bug 1255731",
"url": "https://bugzilla.suse.com/1255731"
},
{
"category": "self",
"summary": "SUSE Bug 1255732",
"url": "https://bugzilla.suse.com/1255732"
},
{
"category": "self",
"summary": "SUSE Bug 1255733",
"url": "https://bugzilla.suse.com/1255733"
},
{
"category": "self",
"summary": "SUSE Bug 1255734",
"url": "https://bugzilla.suse.com/1255734"
},
{
"category": "self",
"summary": "SUSE Bug 1256105",
"url": "https://bugzilla.suse.com/1256105"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14017 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14017/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14524 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14524/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14819 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15079 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15224 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15224/"
}
],
"title": "Security update for curl",
"tracking": {
"current_release_date": "2026-01-14T10:58:55Z",
"generator": {
"date": "2026-01-14T10:58:55Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:20110-1",
"initial_release_date": "2026-01-14T10:58:55Z",
"revision_history": [
{
"date": "2026-01-14T10:58:55Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.aarch64",
"product": {
"name": "curl-8.14.1-160000.4.1.aarch64",
"product_id": "curl-8.14.1-160000.4.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.aarch64",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.aarch64",
"product_id": "libcurl4-8.14.1-160000.4.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.ppc64le",
"product": {
"name": "curl-8.14.1-160000.4.1.ppc64le",
"product_id": "curl-8.14.1-160000.4.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.ppc64le",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.ppc64le",
"product_id": "libcurl4-8.14.1-160000.4.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.s390x",
"product": {
"name": "curl-8.14.1-160000.4.1.s390x",
"product_id": "curl-8.14.1-160000.4.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.s390x",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.s390x",
"product_id": "libcurl4-8.14.1-160000.4.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.x86_64",
"product": {
"name": "curl-8.14.1-160000.4.1.x86_64",
"product_id": "curl-8.14.1-160000.4.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.x86_64",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.x86_64",
"product_id": "libcurl4-8.14.1-160000.4.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.2",
"product": {
"name": "SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:transactional"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64"
},
"product_reference": "curl-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "curl-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.s390x as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x"
},
"product_reference": "curl-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64"
},
"product_reference": "curl-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.s390x as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Micro 6.2",
"product_id": "SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14017",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14017"
}
],
"notes": [
{
"category": "general",
"text": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14017",
"url": "https://www.suse.com/security/cve/CVE-2025-14017"
},
{
"category": "external",
"summary": "SUSE Bug 1256105 for CVE-2025-14017",
"url": "https://bugzilla.suse.com/1256105"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T10:58:55Z",
"details": "moderate"
}
],
"title": "CVE-2025-14017"
},
{
"cve": "CVE-2025-14524",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14524"
}
],
"notes": [
{
"category": "general",
"text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14524",
"url": "https://www.suse.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "SUSE Bug 1255731 for CVE-2025-14524",
"url": "https://bugzilla.suse.com/1255731"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T10:58:55Z",
"details": "moderate"
}
],
"title": "CVE-2025-14524"
},
{
"cve": "CVE-2025-14819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14819"
}
],
"notes": [
{
"category": "general",
"text": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14819",
"url": "https://www.suse.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "SUSE Bug 1255732 for CVE-2025-14819",
"url": "https://bugzilla.suse.com/1255732"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T10:58:55Z",
"details": "moderate"
}
],
"title": "CVE-2025-14819"
},
{
"cve": "CVE-2025-15079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15079"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15079",
"url": "https://www.suse.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "SUSE Bug 1255733 for CVE-2025-15079",
"url": "https://bugzilla.suse.com/1255733"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T10:58:55Z",
"details": "moderate"
}
],
"title": "CVE-2025-15079"
},
{
"cve": "CVE-2025-15224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15224"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15224",
"url": "https://www.suse.com/security/cve/CVE-2025-15224"
},
{
"category": "external",
"summary": "SUSE Bug 1255734 for CVE-2025-15224",
"url": "https://bugzilla.suse.com/1255734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Micro 6.2:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T10:58:55Z",
"details": "moderate"
}
],
"title": "CVE-2025-15224"
}
]
}
SUSE-SU-2026:0052-1
Vulnerability from csaf_suse - Published: 2026-01-07 09:28 - Updated: 2026-01-07 09:28Summary
Security update for curl
Notes
Title of the patch
Security update for curl
Description of the patch
This update for curl fixes the following issues:
- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
- CVE-2025-14819: libssh global knownhost override (bsc#1255732).
- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).
Patchnames
SUSE-2026-52,SUSE-SLE-Module-Basesystem-15-SP7-2026-52
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for curl",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2026-52,SUSE-SLE-Module-Basesystem-15-SP7-2026-52",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_0052-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:0052-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-20260052-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:0052-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023696.html"
},
{
"category": "self",
"summary": "SUSE Bug 1255731",
"url": "https://bugzilla.suse.com/1255731"
},
{
"category": "self",
"summary": "SUSE Bug 1255732",
"url": "https://bugzilla.suse.com/1255732"
},
{
"category": "self",
"summary": "SUSE Bug 1255733",
"url": "https://bugzilla.suse.com/1255733"
},
{
"category": "self",
"summary": "SUSE Bug 1255734",
"url": "https://bugzilla.suse.com/1255734"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14524 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14524/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14819 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15079 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15224 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15224/"
}
],
"title": "Security update for curl",
"tracking": {
"current_release_date": "2026-01-07T09:28:37Z",
"generator": {
"date": "2026-01-07T09:28:37Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:0052-1",
"initial_release_date": "2026-01-07T09:28:37Z",
"revision_history": [
{
"date": "2026-01-07T09:28:37Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150700.7.8.1.aarch64",
"product": {
"name": "curl-8.14.1-150700.7.8.1.aarch64",
"product_id": "curl-8.14.1-150700.7.8.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"product": {
"name": "libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"product_id": "libcurl-devel-8.14.1-150700.7.8.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150700.7.8.1.aarch64",
"product": {
"name": "libcurl-mini4-8.14.1-150700.7.8.1.aarch64",
"product_id": "libcurl-mini4-8.14.1-150700.7.8.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150700.7.8.1.aarch64",
"product": {
"name": "libcurl4-8.14.1-150700.7.8.1.aarch64",
"product_id": "libcurl4-8.14.1-150700.7.8.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "libcurl-devel-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
"product": {
"name": "libcurl-devel-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
"product_id": "libcurl-devel-64bit-8.14.1-150700.7.8.1.aarch64_ilp32"
}
},
{
"category": "product_version",
"name": "libcurl4-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
"product": {
"name": "libcurl4-64bit-8.14.1-150700.7.8.1.aarch64_ilp32",
"product_id": "libcurl4-64bit-8.14.1-150700.7.8.1.aarch64_ilp32"
}
}
],
"category": "architecture",
"name": "aarch64_ilp32"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150700.7.8.1.i586",
"product": {
"name": "curl-8.14.1-150700.7.8.1.i586",
"product_id": "curl-8.14.1-150700.7.8.1.i586"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150700.7.8.1.i586",
"product": {
"name": "libcurl-devel-8.14.1-150700.7.8.1.i586",
"product_id": "libcurl-devel-8.14.1-150700.7.8.1.i586"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150700.7.8.1.i586",
"product": {
"name": "libcurl-mini4-8.14.1-150700.7.8.1.i586",
"product_id": "libcurl-mini4-8.14.1-150700.7.8.1.i586"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150700.7.8.1.i586",
"product": {
"name": "libcurl4-8.14.1-150700.7.8.1.i586",
"product_id": "libcurl4-8.14.1-150700.7.8.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-fish-completion-8.14.1-150700.7.8.1.noarch",
"product": {
"name": "curl-fish-completion-8.14.1-150700.7.8.1.noarch",
"product_id": "curl-fish-completion-8.14.1-150700.7.8.1.noarch"
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.14.1-150700.7.8.1.noarch",
"product": {
"name": "curl-zsh-completion-8.14.1-150700.7.8.1.noarch",
"product_id": "curl-zsh-completion-8.14.1-150700.7.8.1.noarch"
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.14.1-150700.7.8.1.noarch",
"product": {
"name": "libcurl-devel-doc-8.14.1-150700.7.8.1.noarch",
"product_id": "libcurl-devel-doc-8.14.1-150700.7.8.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150700.7.8.1.ppc64le",
"product": {
"name": "curl-8.14.1-150700.7.8.1.ppc64le",
"product_id": "curl-8.14.1-150700.7.8.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"product": {
"name": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"product_id": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150700.7.8.1.ppc64le",
"product": {
"name": "libcurl-mini4-8.14.1-150700.7.8.1.ppc64le",
"product_id": "libcurl-mini4-8.14.1-150700.7.8.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150700.7.8.1.ppc64le",
"product": {
"name": "libcurl4-8.14.1-150700.7.8.1.ppc64le",
"product_id": "libcurl4-8.14.1-150700.7.8.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150700.7.8.1.s390x",
"product": {
"name": "curl-8.14.1-150700.7.8.1.s390x",
"product_id": "curl-8.14.1-150700.7.8.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150700.7.8.1.s390x",
"product": {
"name": "libcurl-devel-8.14.1-150700.7.8.1.s390x",
"product_id": "libcurl-devel-8.14.1-150700.7.8.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150700.7.8.1.s390x",
"product": {
"name": "libcurl-mini4-8.14.1-150700.7.8.1.s390x",
"product_id": "libcurl-mini4-8.14.1-150700.7.8.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150700.7.8.1.s390x",
"product": {
"name": "libcurl4-8.14.1-150700.7.8.1.s390x",
"product_id": "libcurl4-8.14.1-150700.7.8.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-150700.7.8.1.x86_64",
"product": {
"name": "curl-8.14.1-150700.7.8.1.x86_64",
"product_id": "curl-8.14.1-150700.7.8.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"product": {
"name": "libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"product_id": "libcurl-devel-8.14.1-150700.7.8.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.14.1-150700.7.8.1.x86_64",
"product": {
"name": "libcurl-devel-32bit-8.14.1-150700.7.8.1.x86_64",
"product_id": "libcurl-devel-32bit-8.14.1-150700.7.8.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-150700.7.8.1.x86_64",
"product": {
"name": "libcurl-mini4-8.14.1-150700.7.8.1.x86_64",
"product_id": "libcurl-mini4-8.14.1-150700.7.8.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-150700.7.8.1.x86_64",
"product": {
"name": "libcurl4-8.14.1-150700.7.8.1.x86_64",
"product_id": "libcurl4-8.14.1-150700.7.8.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"product": {
"name": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"product_id": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-basesystem:15:sp7"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-150700.7.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64"
},
"product_reference": "curl-8.14.1-150700.7.8.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-150700.7.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le"
},
"product_reference": "curl-8.14.1-150700.7.8.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-150700.7.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x"
},
"product_reference": "curl-8.14.1-150700.7.8.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64"
},
"product_reference": "curl-8.14.1-150700.7.8.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-150700.7.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64"
},
"product_reference": "libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le"
},
"product_reference": "libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-150700.7.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x"
},
"product_reference": "libcurl-devel-8.14.1-150700.7.8.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64"
},
"product_reference": "libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-150700.7.8.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64"
},
"product_reference": "libcurl4-8.14.1-150700.7.8.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-150700.7.8.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le"
},
"product_reference": "libcurl4-8.14.1-150700.7.8.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-150700.7.8.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x"
},
"product_reference": "libcurl4-8.14.1-150700.7.8.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
},
"product_reference": "libcurl4-8.14.1-150700.7.8.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64"
},
"product_reference": "libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14524",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14524"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14524",
"url": "https://www.suse.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "SUSE Bug 1255731 for CVE-2025-14524",
"url": "https://bugzilla.suse.com/1255731"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-14524"
},
{
"cve": "CVE-2025-14819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14819"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14819",
"url": "https://www.suse.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "SUSE Bug 1255732 for CVE-2025-14819",
"url": "https://bugzilla.suse.com/1255732"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-14819"
},
{
"cve": "CVE-2025-15079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15079"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15079",
"url": "https://www.suse.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "SUSE Bug 1255733 for CVE-2025-15079",
"url": "https://bugzilla.suse.com/1255733"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-15079"
},
{
"cve": "CVE-2025-15224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15224"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15224",
"url": "https://www.suse.com/security/cve/CVE-2025-15224"
},
{
"category": "external",
"summary": "SUSE Bug 1255734 for CVE-2025-15224",
"url": "https://bugzilla.suse.com/1255734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:curl-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl-devel-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-32bit-8.14.1-150700.7.8.1.x86_64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:libcurl4-8.14.1-150700.7.8.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-07T09:28:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-15224"
}
]
}
SUSE-SU-2026:20042-1
Vulnerability from csaf_suse - Published: 2026-01-08 15:18 - Updated: 2026-01-08 15:18Summary
Security update for curl
Notes
Title of the patch
Security update for curl
Description of the patch
This update for curl fixes the following issues:
- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
- CVE-2025-14819: libssh global knownhost override (bsc#1255732).
- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).
Patchnames
SUSE-SLE-Micro-6.0-546
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for curl",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for curl fixes the following issues:\n\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-546",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20042-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:20042-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620042-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:20042-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023765.html"
},
{
"category": "self",
"summary": "SUSE Bug 1255731",
"url": "https://bugzilla.suse.com/1255731"
},
{
"category": "self",
"summary": "SUSE Bug 1255732",
"url": "https://bugzilla.suse.com/1255732"
},
{
"category": "self",
"summary": "SUSE Bug 1255733",
"url": "https://bugzilla.suse.com/1255733"
},
{
"category": "self",
"summary": "SUSE Bug 1255734",
"url": "https://bugzilla.suse.com/1255734"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14524 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14524/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14819 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15079 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15224 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15224/"
}
],
"title": "Security update for curl",
"tracking": {
"current_release_date": "2026-01-08T15:18:54Z",
"generator": {
"date": "2026-01-08T15:18:54Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:20042-1",
"initial_release_date": "2026-01-08T15:18:54Z",
"revision_history": [
{
"date": "2026-01-08T15:18:54Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-3.1.aarch64",
"product": {
"name": "curl-8.14.1-3.1.aarch64",
"product_id": "curl-8.14.1-3.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-3.1.aarch64",
"product": {
"name": "libcurl4-8.14.1-3.1.aarch64",
"product_id": "libcurl4-8.14.1-3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-3.1.s390x",
"product": {
"name": "curl-8.14.1-3.1.s390x",
"product_id": "curl-8.14.1-3.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-3.1.s390x",
"product": {
"name": "libcurl4-8.14.1-3.1.s390x",
"product_id": "libcurl4-8.14.1-3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-3.1.x86_64",
"product": {
"name": "curl-8.14.1-3.1.x86_64",
"product_id": "curl-8.14.1-3.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-3.1.x86_64",
"product": {
"name": "libcurl4-8.14.1-3.1.x86_64",
"product_id": "libcurl4-8.14.1-3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-3.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64"
},
"product_reference": "curl-8.14.1-3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-3.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x"
},
"product_reference": "curl-8.14.1-3.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-3.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64"
},
"product_reference": "curl-8.14.1-3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-3.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64"
},
"product_reference": "libcurl4-8.14.1-3.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-3.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x"
},
"product_reference": "libcurl4-8.14.1-3.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-3.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
},
"product_reference": "libcurl4-8.14.1-3.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14524",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14524"
}
],
"notes": [
{
"category": "general",
"text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14524",
"url": "https://www.suse.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "SUSE Bug 1255731 for CVE-2025-14524",
"url": "https://bugzilla.suse.com/1255731"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T15:18:54Z",
"details": "moderate"
}
],
"title": "CVE-2025-14524"
},
{
"cve": "CVE-2025-14819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14819"
}
],
"notes": [
{
"category": "general",
"text": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14819",
"url": "https://www.suse.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "SUSE Bug 1255732 for CVE-2025-14819",
"url": "https://bugzilla.suse.com/1255732"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T15:18:54Z",
"details": "moderate"
}
],
"title": "CVE-2025-14819"
},
{
"cve": "CVE-2025-15079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15079"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15079",
"url": "https://www.suse.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "SUSE Bug 1255733 for CVE-2025-15079",
"url": "https://bugzilla.suse.com/1255733"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T15:18:54Z",
"details": "moderate"
}
],
"title": "CVE-2025-15079"
},
{
"cve": "CVE-2025-15224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15224"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15224",
"url": "https://www.suse.com/security/cve/CVE-2025-15224"
},
{
"category": "external",
"summary": "SUSE Bug 1255734 for CVE-2025-15224",
"url": "https://bugzilla.suse.com/1255734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:curl-8.14.1-3.1.x86_64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.aarch64",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.s390x",
"SUSE Linux Micro 6.0:libcurl4-8.14.1-3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T15:18:54Z",
"details": "moderate"
}
],
"title": "CVE-2025-15224"
}
]
}
SUSE-SU-2026:20082-1
Vulnerability from csaf_suse - Published: 2026-01-14 10:58 - Updated: 2026-01-14 10:58Summary
Security update for curl
Notes
Title of the patch
Security update for curl
Description of the patch
This update for curl fixes the following issues:
This update for curl fixes the following issues:
- CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).
- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
- CVE-2025-14819: libssh global knownhost override (bsc#1255732).
- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).
Patchnames
SUSE-SLES-16.0-140
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for curl",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for curl fixes the following issues:\n\nThis update for curl fixes the following issues:\n\n- CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-140",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_20082-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:20082-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202620082-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:20082-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023816.html"
},
{
"category": "self",
"summary": "SUSE Bug 1255731",
"url": "https://bugzilla.suse.com/1255731"
},
{
"category": "self",
"summary": "SUSE Bug 1255732",
"url": "https://bugzilla.suse.com/1255732"
},
{
"category": "self",
"summary": "SUSE Bug 1255733",
"url": "https://bugzilla.suse.com/1255733"
},
{
"category": "self",
"summary": "SUSE Bug 1255734",
"url": "https://bugzilla.suse.com/1255734"
},
{
"category": "self",
"summary": "SUSE Bug 1256105",
"url": "https://bugzilla.suse.com/1256105"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14017 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14017/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14524 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14524/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14819 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15079 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15224 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15224/"
}
],
"title": "Security update for curl",
"tracking": {
"current_release_date": "2026-01-14T10:58:55Z",
"generator": {
"date": "2026-01-14T10:58:55Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:20082-1",
"initial_release_date": "2026-01-14T10:58:55Z",
"revision_history": [
{
"date": "2026-01-14T10:58:55Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.aarch64",
"product": {
"name": "curl-8.14.1-160000.4.1.aarch64",
"product_id": "curl-8.14.1-160000.4.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.4.1.aarch64",
"product": {
"name": "libcurl-devel-8.14.1-160000.4.1.aarch64",
"product_id": "libcurl-devel-8.14.1-160000.4.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-160000.4.1.aarch64",
"product": {
"name": "libcurl-mini4-8.14.1-160000.4.1.aarch64",
"product_id": "libcurl-mini4-8.14.1-160000.4.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.aarch64",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.aarch64",
"product_id": "libcurl4-8.14.1-160000.4.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
"product": {
"name": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
"product_id": "curl-zsh-completion-8.14.1-160000.4.1.noarch"
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"product": {
"name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"product_id": "libcurl-devel-doc-8.14.1-160000.4.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.ppc64le",
"product": {
"name": "curl-8.14.1-160000.4.1.ppc64le",
"product_id": "curl-8.14.1-160000.4.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
"product": {
"name": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
"product_id": "libcurl-devel-8.14.1-160000.4.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"product": {
"name": "libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"product_id": "libcurl-mini4-8.14.1-160000.4.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.ppc64le",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.ppc64le",
"product_id": "libcurl4-8.14.1-160000.4.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.s390x",
"product": {
"name": "curl-8.14.1-160000.4.1.s390x",
"product_id": "curl-8.14.1-160000.4.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.4.1.s390x",
"product": {
"name": "libcurl-devel-8.14.1-160000.4.1.s390x",
"product_id": "libcurl-devel-8.14.1-160000.4.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-160000.4.1.s390x",
"product": {
"name": "libcurl-mini4-8.14.1-160000.4.1.s390x",
"product_id": "libcurl-mini4-8.14.1-160000.4.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.s390x",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.s390x",
"product_id": "libcurl4-8.14.1-160000.4.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.x86_64",
"product": {
"name": "curl-8.14.1-160000.4.1.x86_64",
"product_id": "curl-8.14.1-160000.4.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.4.1.x86_64",
"product": {
"name": "libcurl-devel-8.14.1-160000.4.1.x86_64",
"product_id": "libcurl-devel-8.14.1-160000.4.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-mini4-8.14.1-160000.4.1.x86_64",
"product": {
"name": "libcurl-mini4-8.14.1-160000.4.1.x86_64",
"product_id": "libcurl-mini4-8.14.1-160000.4.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.x86_64",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.x86_64",
"product_id": "libcurl4-8.14.1-160000.4.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64"
},
"product_reference": "curl-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "curl-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x"
},
"product_reference": "curl-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64"
},
"product_reference": "curl-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.14.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch"
},
"product_reference": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch"
},
"product_reference": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-mini4-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64"
},
"product_reference": "libcurl-mini4-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-mini4-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-mini4-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x"
},
"product_reference": "libcurl-mini4-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-mini4-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64"
},
"product_reference": "libcurl-mini4-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64"
},
"product_reference": "curl-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "curl-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x"
},
"product_reference": "curl-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64"
},
"product_reference": "curl-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.14.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch"
},
"product_reference": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch"
},
"product_reference": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-mini4-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64"
},
"product_reference": "libcurl-mini4-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-mini4-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-mini4-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x"
},
"product_reference": "libcurl-mini4-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-mini4-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64"
},
"product_reference": "libcurl-mini4-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14017",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14017"
}
],
"notes": [
{
"category": "general",
"text": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14017",
"url": "https://www.suse.com/security/cve/CVE-2025-14017"
},
{
"category": "external",
"summary": "SUSE Bug 1256105 for CVE-2025-14017",
"url": "https://bugzilla.suse.com/1256105"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T10:58:55Z",
"details": "moderate"
}
],
"title": "CVE-2025-14017"
},
{
"cve": "CVE-2025-14524",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14524"
}
],
"notes": [
{
"category": "general",
"text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14524",
"url": "https://www.suse.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "SUSE Bug 1255731 for CVE-2025-14524",
"url": "https://bugzilla.suse.com/1255731"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T10:58:55Z",
"details": "moderate"
}
],
"title": "CVE-2025-14524"
},
{
"cve": "CVE-2025-14819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14819"
}
],
"notes": [
{
"category": "general",
"text": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14819",
"url": "https://www.suse.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "SUSE Bug 1255732 for CVE-2025-14819",
"url": "https://bugzilla.suse.com/1255732"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T10:58:55Z",
"details": "moderate"
}
],
"title": "CVE-2025-14819"
},
{
"cve": "CVE-2025-15079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15079"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15079",
"url": "https://www.suse.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "SUSE Bug 1255733 for CVE-2025-15079",
"url": "https://bugzilla.suse.com/1255733"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T10:58:55Z",
"details": "moderate"
}
],
"title": "CVE-2025-15079"
},
{
"cve": "CVE-2025-15224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15224"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15224",
"url": "https://www.suse.com/security/cve/CVE-2025-15224"
},
{
"category": "external",
"summary": "SUSE Bug 1255734 for CVE-2025-15224",
"url": "https://bugzilla.suse.com/1255734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server 16.0:libcurl4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl-mini4-8.14.1-160000.4.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T10:58:55Z",
"details": "moderate"
}
],
"title": "CVE-2025-15224"
}
]
}
OPENSUSE-SU-2026:20031-1
Vulnerability from csaf_opensuse - Published: 2026-01-14 11:01 - Updated: 2026-01-14 11:01Summary
Security update for curl
Notes
Title of the patch
Security update for curl
Description of the patch
This update for curl fixes the following issues:
This update for curl fixes the following issues:
- CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).
- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).
- CVE-2025-14819: libssh global knownhost override (bsc#1255732).
- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).
- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).
Patchnames
openSUSE-Leap-16.0-140
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for curl",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for curl fixes the following issues:\n\nThis update for curl fixes the following issues:\n\n- CVE-2025-14017: broken TLS options for threaded LDAPS (bsc#1256105).\n- CVE-2025-14524: bearer token leak on cross-protocol redirect (bsc#1255731).\n- CVE-2025-14819: libssh global knownhost override (bsc#1255732).\n- CVE-2025-15079: libssh key passphrase bypass without agent set (bsc#1255733).\n- CVE-2025-15224: OpenSSL partial chain store policy bypass (bsc#1255734).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-140",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20031-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1255731",
"url": "https://bugzilla.suse.com/1255731"
},
{
"category": "self",
"summary": "SUSE Bug 1255732",
"url": "https://bugzilla.suse.com/1255732"
},
{
"category": "self",
"summary": "SUSE Bug 1255733",
"url": "https://bugzilla.suse.com/1255733"
},
{
"category": "self",
"summary": "SUSE Bug 1255734",
"url": "https://bugzilla.suse.com/1255734"
},
{
"category": "self",
"summary": "SUSE Bug 1256105",
"url": "https://bugzilla.suse.com/1256105"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14017 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14017/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14524 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14524/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14819 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15079 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15224 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15224/"
}
],
"title": "Security update for curl",
"tracking": {
"current_release_date": "2026-01-14T11:01:44Z",
"generator": {
"date": "2026-01-14T11:01:44Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:20031-1",
"initial_release_date": "2026-01-14T11:01:44Z",
"revision_history": [
{
"date": "2026-01-14T11:01:44Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.aarch64",
"product": {
"name": "curl-8.14.1-160000.4.1.aarch64",
"product_id": "curl-8.14.1-160000.4.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.4.1.aarch64",
"product": {
"name": "libcurl-devel-8.14.1-160000.4.1.aarch64",
"product_id": "libcurl-devel-8.14.1-160000.4.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.aarch64",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.aarch64",
"product_id": "libcurl4-8.14.1-160000.4.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-fish-completion-8.14.1-160000.4.1.noarch",
"product": {
"name": "curl-fish-completion-8.14.1-160000.4.1.noarch",
"product_id": "curl-fish-completion-8.14.1-160000.4.1.noarch"
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
"product": {
"name": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
"product_id": "curl-zsh-completion-8.14.1-160000.4.1.noarch"
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"product": {
"name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"product_id": "libcurl-devel-doc-8.14.1-160000.4.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.ppc64le",
"product": {
"name": "curl-8.14.1-160000.4.1.ppc64le",
"product_id": "curl-8.14.1-160000.4.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
"product": {
"name": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
"product_id": "libcurl-devel-8.14.1-160000.4.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.ppc64le",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.ppc64le",
"product_id": "libcurl4-8.14.1-160000.4.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.s390x",
"product": {
"name": "curl-8.14.1-160000.4.1.s390x",
"product_id": "curl-8.14.1-160000.4.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.4.1.s390x",
"product": {
"name": "libcurl-devel-8.14.1-160000.4.1.s390x",
"product_id": "libcurl-devel-8.14.1-160000.4.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.s390x",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.s390x",
"product_id": "libcurl4-8.14.1-160000.4.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.14.1-160000.4.1.x86_64",
"product": {
"name": "curl-8.14.1-160000.4.1.x86_64",
"product_id": "curl-8.14.1-160000.4.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.14.1-160000.4.1.x86_64",
"product": {
"name": "libcurl-devel-8.14.1-160000.4.1.x86_64",
"product_id": "libcurl-devel-8.14.1-160000.4.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.14.1-160000.4.1.x86_64",
"product": {
"name": "libcurl4-8.14.1-160000.4.1.x86_64",
"product_id": "libcurl4-8.14.1-160000.4.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64"
},
"product_reference": "curl-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "curl-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x"
},
"product_reference": "curl-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.14.1-160000.4.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64"
},
"product_reference": "curl-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-8.14.1-160000.4.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch"
},
"product_reference": "curl-fish-completion-8.14.1-160000.4.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.14.1-160000.4.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch"
},
"product_reference": "curl-zsh-completion-8.14.1-160000.4.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.14.1-160000.4.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64"
},
"product_reference": "libcurl-devel-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.14.1-160000.4.1.noarch as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch"
},
"product_reference": "libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.14.1-160000.4.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
},
"product_reference": "libcurl4-8.14.1-160000.4.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14017",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14017"
}
],
"notes": [
{
"category": "general",
"text": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14017",
"url": "https://www.suse.com/security/cve/CVE-2025-14017"
},
{
"category": "external",
"summary": "SUSE Bug 1256105 for CVE-2025-14017",
"url": "https://bugzilla.suse.com/1256105"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T11:01:44Z",
"details": "moderate"
}
],
"title": "CVE-2025-14017"
},
{
"cve": "CVE-2025-14524",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14524"
}
],
"notes": [
{
"category": "general",
"text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14524",
"url": "https://www.suse.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "SUSE Bug 1255731 for CVE-2025-14524",
"url": "https://bugzilla.suse.com/1255731"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T11:01:44Z",
"details": "moderate"
}
],
"title": "CVE-2025-14524"
},
{
"cve": "CVE-2025-14819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14819"
}
],
"notes": [
{
"category": "general",
"text": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14819",
"url": "https://www.suse.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "SUSE Bug 1255732 for CVE-2025-14819",
"url": "https://bugzilla.suse.com/1255732"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T11:01:44Z",
"details": "moderate"
}
],
"title": "CVE-2025-14819"
},
{
"cve": "CVE-2025-15079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15079"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15079",
"url": "https://www.suse.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "SUSE Bug 1255733 for CVE-2025-15079",
"url": "https://bugzilla.suse.com/1255733"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T11:01:44Z",
"details": "moderate"
}
],
"title": "CVE-2025-15079"
},
{
"cve": "CVE-2025-15224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15224"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15224",
"url": "https://www.suse.com/security/cve/CVE-2025-15224"
},
{
"category": "external",
"summary": "SUSE Bug 1255734 for CVE-2025-15224",
"url": "https://bugzilla.suse.com/1255734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:curl-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:curl-fish-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:curl-zsh-completion-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl-devel-8.14.1-160000.4.1.x86_64",
"openSUSE Leap 16.0:libcurl-devel-doc-8.14.1-160000.4.1.noarch",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.aarch64",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.ppc64le",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.s390x",
"openSUSE Leap 16.0:libcurl4-8.14.1-160000.4.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-14T11:01:44Z",
"details": "moderate"
}
],
"title": "CVE-2025-15224"
}
]
}
OPENSUSE-SU-2026:10017-1
Vulnerability from csaf_opensuse - Published: 2026-01-08 00:00 - Updated: 2026-01-08 00:00Summary
curl-8.18.0-1.1 on GA media
Notes
Title of the patch
curl-8.18.0-1.1 on GA media
Description of the patch
These are all security issues fixed in the curl-8.18.0-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2026-10017
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "curl-8.18.0-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the curl-8.18.0-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-10017",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10017-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14017 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14017/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14524 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14524/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-14819 page",
"url": "https://www.suse.com/security/cve/CVE-2025-14819/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15079 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15079/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-15224 page",
"url": "https://www.suse.com/security/cve/CVE-2025-15224/"
}
],
"title": "curl-8.18.0-1.1 on GA media",
"tracking": {
"current_release_date": "2026-01-08T00:00:00Z",
"generator": {
"date": "2026-01-08T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:10017-1",
"initial_release_date": "2026-01-08T00:00:00Z",
"revision_history": [
{
"date": "2026-01-08T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "curl-8.18.0-1.1.aarch64",
"product": {
"name": "curl-8.18.0-1.1.aarch64",
"product_id": "curl-8.18.0-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "curl-fish-completion-8.18.0-1.1.aarch64",
"product": {
"name": "curl-fish-completion-8.18.0-1.1.aarch64",
"product_id": "curl-fish-completion-8.18.0-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.18.0-1.1.aarch64",
"product": {
"name": "curl-zsh-completion-8.18.0-1.1.aarch64",
"product_id": "curl-zsh-completion-8.18.0-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.18.0-1.1.aarch64",
"product": {
"name": "libcurl-devel-8.18.0-1.1.aarch64",
"product_id": "libcurl-devel-8.18.0-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.18.0-1.1.aarch64",
"product": {
"name": "libcurl-devel-32bit-8.18.0-1.1.aarch64",
"product_id": "libcurl-devel-32bit-8.18.0-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.18.0-1.1.aarch64",
"product": {
"name": "libcurl-devel-doc-8.18.0-1.1.aarch64",
"product_id": "libcurl-devel-doc-8.18.0-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.18.0-1.1.aarch64",
"product": {
"name": "libcurl4-8.18.0-1.1.aarch64",
"product_id": "libcurl4-8.18.0-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.18.0-1.1.aarch64",
"product": {
"name": "libcurl4-32bit-8.18.0-1.1.aarch64",
"product_id": "libcurl4-32bit-8.18.0-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "wcurl-8.18.0-1.1.aarch64",
"product": {
"name": "wcurl-8.18.0-1.1.aarch64",
"product_id": "wcurl-8.18.0-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.18.0-1.1.ppc64le",
"product": {
"name": "curl-8.18.0-1.1.ppc64le",
"product_id": "curl-8.18.0-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "curl-fish-completion-8.18.0-1.1.ppc64le",
"product": {
"name": "curl-fish-completion-8.18.0-1.1.ppc64le",
"product_id": "curl-fish-completion-8.18.0-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.18.0-1.1.ppc64le",
"product": {
"name": "curl-zsh-completion-8.18.0-1.1.ppc64le",
"product_id": "curl-zsh-completion-8.18.0-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.18.0-1.1.ppc64le",
"product": {
"name": "libcurl-devel-8.18.0-1.1.ppc64le",
"product_id": "libcurl-devel-8.18.0-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"product": {
"name": "libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"product_id": "libcurl-devel-32bit-8.18.0-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.18.0-1.1.ppc64le",
"product": {
"name": "libcurl-devel-doc-8.18.0-1.1.ppc64le",
"product_id": "libcurl-devel-doc-8.18.0-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl4-8.18.0-1.1.ppc64le",
"product": {
"name": "libcurl4-8.18.0-1.1.ppc64le",
"product_id": "libcurl4-8.18.0-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.18.0-1.1.ppc64le",
"product": {
"name": "libcurl4-32bit-8.18.0-1.1.ppc64le",
"product_id": "libcurl4-32bit-8.18.0-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "wcurl-8.18.0-1.1.ppc64le",
"product": {
"name": "wcurl-8.18.0-1.1.ppc64le",
"product_id": "wcurl-8.18.0-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.18.0-1.1.s390x",
"product": {
"name": "curl-8.18.0-1.1.s390x",
"product_id": "curl-8.18.0-1.1.s390x"
}
},
{
"category": "product_version",
"name": "curl-fish-completion-8.18.0-1.1.s390x",
"product": {
"name": "curl-fish-completion-8.18.0-1.1.s390x",
"product_id": "curl-fish-completion-8.18.0-1.1.s390x"
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.18.0-1.1.s390x",
"product": {
"name": "curl-zsh-completion-8.18.0-1.1.s390x",
"product_id": "curl-zsh-completion-8.18.0-1.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.18.0-1.1.s390x",
"product": {
"name": "libcurl-devel-8.18.0-1.1.s390x",
"product_id": "libcurl-devel-8.18.0-1.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.18.0-1.1.s390x",
"product": {
"name": "libcurl-devel-32bit-8.18.0-1.1.s390x",
"product_id": "libcurl-devel-32bit-8.18.0-1.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.18.0-1.1.s390x",
"product": {
"name": "libcurl-devel-doc-8.18.0-1.1.s390x",
"product_id": "libcurl-devel-doc-8.18.0-1.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-8.18.0-1.1.s390x",
"product": {
"name": "libcurl4-8.18.0-1.1.s390x",
"product_id": "libcurl4-8.18.0-1.1.s390x"
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.18.0-1.1.s390x",
"product": {
"name": "libcurl4-32bit-8.18.0-1.1.s390x",
"product_id": "libcurl4-32bit-8.18.0-1.1.s390x"
}
},
{
"category": "product_version",
"name": "wcurl-8.18.0-1.1.s390x",
"product": {
"name": "wcurl-8.18.0-1.1.s390x",
"product_id": "wcurl-8.18.0-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "curl-8.18.0-1.1.x86_64",
"product": {
"name": "curl-8.18.0-1.1.x86_64",
"product_id": "curl-8.18.0-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "curl-fish-completion-8.18.0-1.1.x86_64",
"product": {
"name": "curl-fish-completion-8.18.0-1.1.x86_64",
"product_id": "curl-fish-completion-8.18.0-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "curl-zsh-completion-8.18.0-1.1.x86_64",
"product": {
"name": "curl-zsh-completion-8.18.0-1.1.x86_64",
"product_id": "curl-zsh-completion-8.18.0-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-8.18.0-1.1.x86_64",
"product": {
"name": "libcurl-devel-8.18.0-1.1.x86_64",
"product_id": "libcurl-devel-8.18.0-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-32bit-8.18.0-1.1.x86_64",
"product": {
"name": "libcurl-devel-32bit-8.18.0-1.1.x86_64",
"product_id": "libcurl-devel-32bit-8.18.0-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl-devel-doc-8.18.0-1.1.x86_64",
"product": {
"name": "libcurl-devel-doc-8.18.0-1.1.x86_64",
"product_id": "libcurl-devel-doc-8.18.0-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-8.18.0-1.1.x86_64",
"product": {
"name": "libcurl4-8.18.0-1.1.x86_64",
"product_id": "libcurl4-8.18.0-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "libcurl4-32bit-8.18.0-1.1.x86_64",
"product": {
"name": "libcurl4-32bit-8.18.0-1.1.x86_64",
"product_id": "libcurl4-32bit-8.18.0-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "wcurl-8.18.0-1.1.x86_64",
"product": {
"name": "wcurl-8.18.0-1.1.x86_64",
"product_id": "wcurl-8.18.0-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.18.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64"
},
"product_reference": "curl-8.18.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.18.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le"
},
"product_reference": "curl-8.18.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.18.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-8.18.0-1.1.s390x"
},
"product_reference": "curl-8.18.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-8.18.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64"
},
"product_reference": "curl-8.18.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-8.18.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64"
},
"product_reference": "curl-fish-completion-8.18.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-8.18.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le"
},
"product_reference": "curl-fish-completion-8.18.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-8.18.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x"
},
"product_reference": "curl-fish-completion-8.18.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-fish-completion-8.18.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64"
},
"product_reference": "curl-fish-completion-8.18.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.18.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64"
},
"product_reference": "curl-zsh-completion-8.18.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.18.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le"
},
"product_reference": "curl-zsh-completion-8.18.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.18.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x"
},
"product_reference": "curl-zsh-completion-8.18.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "curl-zsh-completion-8.18.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64"
},
"product_reference": "curl-zsh-completion-8.18.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.18.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64"
},
"product_reference": "libcurl-devel-8.18.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.18.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le"
},
"product_reference": "libcurl-devel-8.18.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.18.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x"
},
"product_reference": "libcurl-devel-8.18.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-8.18.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64"
},
"product_reference": "libcurl-devel-8.18.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-8.18.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64"
},
"product_reference": "libcurl-devel-32bit-8.18.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-8.18.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le"
},
"product_reference": "libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-8.18.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x"
},
"product_reference": "libcurl-devel-32bit-8.18.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-32bit-8.18.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64"
},
"product_reference": "libcurl-devel-32bit-8.18.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.18.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64"
},
"product_reference": "libcurl-devel-doc-8.18.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.18.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le"
},
"product_reference": "libcurl-devel-doc-8.18.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.18.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x"
},
"product_reference": "libcurl-devel-doc-8.18.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl-devel-doc-8.18.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64"
},
"product_reference": "libcurl-devel-doc-8.18.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.18.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64"
},
"product_reference": "libcurl4-8.18.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.18.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le"
},
"product_reference": "libcurl4-8.18.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.18.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x"
},
"product_reference": "libcurl4-8.18.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-8.18.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64"
},
"product_reference": "libcurl4-8.18.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-8.18.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64"
},
"product_reference": "libcurl4-32bit-8.18.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-8.18.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le"
},
"product_reference": "libcurl4-32bit-8.18.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-8.18.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x"
},
"product_reference": "libcurl4-32bit-8.18.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libcurl4-32bit-8.18.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64"
},
"product_reference": "libcurl4-32bit-8.18.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-8.18.0-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64"
},
"product_reference": "wcurl-8.18.0-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-8.18.0-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le"
},
"product_reference": "wcurl-8.18.0-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-8.18.0-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x"
},
"product_reference": "wcurl-8.18.0-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "wcurl-8.18.0-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
},
"product_reference": "wcurl-8.18.0-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-14017",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14017"
}
],
"notes": [
{
"category": "general",
"text": "When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl,\nchanging TLS options in one thread would inadvertently change them globally\nand therefore possibly also affect other concurrently setup transfers.\n\nDisabling certificate verification for a specific transfer could\nunintentionally disable the feature for other threads as well.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14017",
"url": "https://www.suse.com/security/cve/CVE-2025-14017"
},
{
"category": "external",
"summary": "SUSE Bug 1256105 for CVE-2025-14017",
"url": "https://bugzilla.suse.com/1256105"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-14017"
},
{
"cve": "CVE-2025-14524",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14524"
}
],
"notes": [
{
"category": "general",
"text": "When an OAuth2 bearer token is used for an HTTP(S) transfer, and that transfer\nperforms a cross-protocol redirect to a second URL that uses an IMAP, LDAP,\nPOP3 or SMTP scheme, curl might wrongly pass on the bearer token to the new\ntarget host.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14524",
"url": "https://www.suse.com/security/cve/CVE-2025-14524"
},
{
"category": "external",
"summary": "SUSE Bug 1255731 for CVE-2025-14524",
"url": "https://bugzilla.suse.com/1255731"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-14524"
},
{
"cve": "CVE-2025-14819",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-14819"
}
],
"notes": [
{
"category": "general",
"text": "When doing TLS related transfers with reused easy or multi handles and\naltering the `CURLSSLOPT_NO_PARTIALCHAIN` option, libcurl could accidentally\nreuse a CA store cached in memory for which the partial chain option was\nreversed. Contrary to the user\u0027s wishes and expectations. This could make\nlibcurl find and accept a trust chain that it otherwise would not.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-14819",
"url": "https://www.suse.com/security/cve/CVE-2025-14819"
},
{
"category": "external",
"summary": "SUSE Bug 1255732 for CVE-2025-14819",
"url": "https://bugzilla.suse.com/1255732"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-14819"
},
{
"cve": "CVE-2025-15079",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15079"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15079",
"url": "https://www.suse.com/security/cve/CVE-2025-15079"
},
{
"category": "external",
"summary": "SUSE Bug 1255733 for CVE-2025-15079",
"url": "https://bugzilla.suse.com/1255733"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-15079"
},
{
"cve": "CVE-2025-15224",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-15224"
}
],
"notes": [
{
"category": "general",
"text": "When doing SSH-based transfers using either SCP or SFTP, and asked to do\npublic key authentication, curl would wrongly still ask and authenticate using\na locally running SSH agent.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-15224",
"url": "https://www.suse.com/security/cve/CVE-2025-15224"
},
{
"category": "external",
"summary": "SUSE Bug 1255734 for CVE-2025-15224",
"url": "https://bugzilla.suse.com/1255734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:curl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-fish-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:curl-zsh-completion-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl-devel-doc-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-32bit-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:libcurl4-8.18.0-1.1.x86_64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.aarch64",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.ppc64le",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.s390x",
"openSUSE Tumbleweed:wcurl-8.18.0-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-01-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-15224"
}
]
}
CERTFR-2026-AVI-0010
Vulnerability from certfr_avis - Published: 2026-01-07 - Updated: 2026-01-07
De multiples vulnérabilités ont été découvertes dans Curl. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Curl | cURL et libcurl | Curl versions 7.17.x à 8.x antérieures à 8.18.0 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Curl versions 7.17.x \u00e0 8.x ant\u00e9rieures \u00e0 8.18.0",
"product": {
"name": "cURL et libcurl",
"vendor": {
"name": "Curl",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-14017",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
},
{
"name": "CVE-2025-5025",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5025"
},
{
"name": "CVE-2025-13034",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13034"
},
{
"name": "CVE-2025-14524",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14524"
},
{
"name": "CVE-2025-15079",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15079"
},
{
"name": "CVE-2025-14819",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14819"
},
{
"name": "CVE-2025-15224",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15224"
}
],
"initial_release_date": "2026-01-07T00:00:00",
"last_revision_date": "2026-01-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0010",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-01-07T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Curl. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Curl",
"vendor_advisories": [
{
"published_at": "2026-01-07",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-15079",
"url": "https://curl.se/docs/CVE-2025-15079.html"
},
{
"published_at": "2026-01-07",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-14819",
"url": "https://curl.se/docs/CVE-2025-14819.html"
},
{
"published_at": "2026-01-07",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-15224",
"url": "https://curl.se/docs/CVE-2025-15224.html"
},
{
"published_at": "2026-01-06",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-14524",
"url": "https://curl.se/docs/CVE-2025-14524.html"
},
{
"published_at": "2026-01-07",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-13034",
"url": "https://curl.se/docs/CVE-2025-13034.html"
},
{
"published_at": "2026-01-07",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-14017",
"url": "https://curl.se/docs/CVE-2025-14017.html"
}
]
}
CERTFR-2026-AVI-0093
Vulnerability from certfr_avis - Published: 2026-01-28 - Updated: 2026-01-28
De multiples vulnérabilités ont été découvertes dans Tenable Network Monitor. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Tenable | Nessus Network Monitor | Network Monitor versions antérieures à 6.5.3 |
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Network Monitor versions ant\u00e9rieures \u00e0 6.5.3",
"product": {
"name": "Nessus Network Monitor",
"vendor": {
"name": "Tenable",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2023-7104",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-7104"
},
{
"name": "CVE-2024-0232",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0232"
},
{
"name": "CVE-2025-10148",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10148"
},
{
"name": "CVE-2025-11731",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-11731"
},
{
"name": "CVE-2025-49794",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49794"
},
{
"name": "CVE-2024-8176",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-8176"
},
{
"name": "CVE-2025-10966",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10966"
},
{
"name": "CVE-2025-59375",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-59375"
},
{
"name": "CVE-2025-7425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-7425"
},
{
"name": "CVE-2025-14017",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
},
{
"name": "CVE-2025-5025",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5025"
},
{
"name": "CVE-2025-13034",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13034"
},
{
"name": "CVE-2025-10911",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-10911"
},
{
"name": "CVE-2025-14524",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14524"
},
{
"name": "CVE-2025-6021",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6021"
},
{
"name": "CVE-2025-62408",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-62408"
},
{
"name": "CVE-2025-15079",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15079"
},
{
"name": "CVE-2025-14819",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14819"
},
{
"name": "CVE-2025-4947",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-4947"
},
{
"name": "CVE-2025-49796",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-49796"
},
{
"name": "CVE-2025-15224",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15224"
},
{
"name": "CVE-2025-31498",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-31498"
}
],
"initial_release_date": "2026-01-28T00:00:00",
"last_revision_date": "2026-01-28T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0093",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-01-28T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Tenable Network Monitor. Elles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Tenable Network Monitor",
"vendor_advisories": [
{
"published_at": "2026-01-27",
"title": "Bulletin de s\u00e9curit\u00e9 Tenable tns-2026-02",
"url": "https://www.tenable.com/security/tns-2026-02"
}
]
}
CERTFR-2026-AVI-0010
Vulnerability from certfr_avis - Published: 2026-01-07 - Updated: 2026-01-07
De multiples vulnérabilités ont été découvertes dans Curl. Elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données et un contournement de la politique de sécurité.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Curl | cURL et libcurl | Curl versions 7.17.x à 8.x antérieures à 8.18.0 |
References
| Title | Publication Time | Tags | ||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Curl versions 7.17.x \u00e0 8.x ant\u00e9rieures \u00e0 8.18.0",
"product": {
"name": "cURL et libcurl",
"vendor": {
"name": "Curl",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-14017",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
},
{
"name": "CVE-2025-5025",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-5025"
},
{
"name": "CVE-2025-13034",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-13034"
},
{
"name": "CVE-2025-14524",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14524"
},
{
"name": "CVE-2025-15079",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15079"
},
{
"name": "CVE-2025-14819",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-14819"
},
{
"name": "CVE-2025-15224",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-15224"
}
],
"initial_release_date": "2026-01-07T00:00:00",
"last_revision_date": "2026-01-07T00:00:00",
"links": [],
"reference": "CERTFR-2026-AVI-0010",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2026-01-07T00:00:00.000000"
}
],
"risks": [
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Curl. Elles permettent \u00e0 un attaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un contournement de la politique de s\u00e9curit\u00e9.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Curl",
"vendor_advisories": [
{
"published_at": "2026-01-07",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-15079",
"url": "https://curl.se/docs/CVE-2025-15079.html"
},
{
"published_at": "2026-01-07",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-14819",
"url": "https://curl.se/docs/CVE-2025-14819.html"
},
{
"published_at": "2026-01-07",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-15224",
"url": "https://curl.se/docs/CVE-2025-15224.html"
},
{
"published_at": "2026-01-06",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-14524",
"url": "https://curl.se/docs/CVE-2025-14524.html"
},
{
"published_at": "2026-01-07",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-13034",
"url": "https://curl.se/docs/CVE-2025-13034.html"
},
{
"published_at": "2026-01-07",
"title": "Bulletin de s\u00e9curit\u00e9 Curl CVE-2025-14017",
"url": "https://curl.se/docs/CVE-2025-14017.html"
}
]
}
WID-SEC-W-2026-0030
Vulnerability from csaf_certbund - Published: 2026-01-06 23:00 - Updated: 2026-01-27 23:00Summary
cURL: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
cURL ist eine Client-Software, die das Austauschen von Dateien mittels mehrerer Protokolle wie z. B. HTTP oder FTP erlaubt.
Angriff
Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder vertrauliche Informationen offenzulegen.
Betroffene Betriebssysteme
- Sonstiges
- UNIX
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "cURL ist eine Client-Software, die das Austauschen von Dateien mittels mehrerer Protokolle wie z. B. HTTP oder FTP erlaubt.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein Angreifer kann mehrere Schwachstellen in cURL ausnutzen, um Sicherheitsvorkehrungen zu umgehen oder vertrauliche Informationen offenzulegen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges\n- UNIX",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2026-0030 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-0030.json"
},
{
"category": "self",
"summary": "WID-SEC-2026-0030 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-0030"
},
{
"category": "external",
"summary": "Project curl Security Advisory vom 2026-01-06",
"url": "https://curl.se/docs/CVE-2025-15224.html"
},
{
"category": "external",
"summary": "Project curl Security Advisory vom 2026-01-06",
"url": "https://curl.se/docs/CVE-2025-15079.html"
},
{
"category": "external",
"summary": "Project curl Security Advisory vom 2026-01-06",
"url": "https://curl.se/docs/CVE-2025-14819.html"
},
{
"category": "external",
"summary": "Project curl Security Advisory vom 2026-01-06",
"url": "https://curl.se/docs/CVE-2025-14524.html"
},
{
"category": "external",
"summary": "Project curl Security Advisory vom 2026-01-06",
"url": "https://curl.se/docs/CVE-2025-14017.html"
},
{
"category": "external",
"summary": "Project curl Security Advisory vom 2026-01-06",
"url": "https://curl.se/docs/CVE-2025-13034.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0050-1 vom 2026-01-07",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023698.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0052-1 vom 2026-01-07",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023696.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0051-1 vom 2026-01-07",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023697.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0066-1 vom 2026-01-08",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023711.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0077-1 vom 2026-01-09",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CCUZ47ZAPZKRFVFRPWIPP3KM2XGIRDMB/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0078-1 vom 2026-01-09",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023713.html"
},
{
"category": "external",
"summary": "openSUSE Security Update OPENSUSE-SU-2026:10017-1 vom 2026-01-09",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/KOOXMCTVUTDBJAD5HQRMQVZJRZJF2ZXZ/"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0119-1 vom 2026-01-13",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023738.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20062-1 vom 2026-01-15",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023749.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20042-1 vom 2026-01-15",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023765.html"
},
{
"category": "external",
"summary": "openSUSE Security Update OPENSUSE-SU-2026:20031-1 vom 2026-01-15",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/FSLWWKBPXO4RTMMBYCCKFIGY2YFQPHSX/"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-2026-E27B23AF78 vom 2026-01-20",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-e27b23af78"
},
{
"category": "external",
"summary": "Fedora Security Advisory FEDORA-2026-3F0F0F85BE vom 2026-01-20",
"url": "https://bodhi.fedoraproject.org/updates/FEDORA-2026-3f0f0f85be"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20082-1 vom 2026-01-20",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023816.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:0221-1 vom 2026-01-22",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023864.html"
},
{
"category": "external",
"summary": "SUSE Security Update SUSE-SU-2026:20110-1 vom 2026-01-23",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2026-January/023878.html"
},
{
"category": "external",
"summary": "Tenable Security Advisory TNS-2026-02 vom 2026-01-27",
"url": "https://de.tenable.com/security/tns-2026-02"
}
],
"source_lang": "en-US",
"title": "cURL: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2026-01-27T23:00:00.000+00:00",
"generator": {
"date": "2026-01-28T09:21:48.461+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.5.0"
}
},
"id": "WID-SEC-W-2026-0030",
"initial_release_date": "2026-01-06T23:00:00.000+00:00",
"revision_history": [
{
"date": "2026-01-06T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2026-01-07T23:00:00.000+00:00",
"number": "2",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-08T23:00:00.000+00:00",
"number": "3",
"summary": "Neue Updates von SUSE und European Union Vulnerability Database aufgenommen"
},
{
"date": "2026-01-11T23:00:00.000+00:00",
"number": "4",
"summary": "Neue Updates von SUSE und openSUSE aufgenommen"
},
{
"date": "2026-01-13T23:00:00.000+00:00",
"number": "5",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-14T23:00:00.000+00:00",
"number": "6",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-15T23:00:00.000+00:00",
"number": "7",
"summary": "Neue Updates von openSUSE aufgenommen"
},
{
"date": "2026-01-19T23:00:00.000+00:00",
"number": "8",
"summary": "Neue Updates von Fedora aufgenommen"
},
{
"date": "2026-01-20T23:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-22T23:00:00.000+00:00",
"number": "10",
"summary": "Neue Updates von SUSE aufgenommen"
},
{
"date": "2026-01-27T23:00:00.000+00:00",
"number": "11",
"summary": "Neue Updates von Tenable aufgenommen"
}
],
"status": "final",
"version": "11"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Fedora Linux",
"product": {
"name": "Fedora Linux",
"product_id": "74185",
"product_identification_helper": {
"cpe": "cpe:/o:fedoraproject:fedora:-"
}
}
}
],
"category": "vendor",
"name": "Fedora"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c8.18.0",
"product": {
"name": "Open Source cURL \u003c8.18.0",
"product_id": "T049738"
}
},
{
"category": "product_version",
"name": "8.18.0",
"product": {
"name": "Open Source cURL 8.18.0",
"product_id": "T049738-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:curl:curl:8.18.0"
}
}
}
],
"category": "product_name",
"name": "cURL"
}
],
"category": "vendor",
"name": "Open Source"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux",
"product": {
"name": "SUSE Linux",
"product_id": "T002207",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse_linux:-"
}
}
},
{
"category": "product_name",
"name": "SUSE openSUSE",
"product": {
"name": "SUSE openSUSE",
"product_id": "T027843",
"product_identification_helper": {
"cpe": "cpe:/o:suse:opensuse:-"
}
}
}
],
"category": "vendor",
"name": "SUSE"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c6.5.3",
"product": {
"name": "Tenable Security Nessus Network Monitor \u003c6.5.3",
"product_id": "T050330"
}
},
{
"category": "product_version",
"name": "6.5.3",
"product": {
"name": "Tenable Security Nessus Network Monitor 6.5.3",
"product_id": "T050330-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:tenable:nessus_network_monitor:6.5.3"
}
}
}
],
"category": "product_name",
"name": "Nessus Network Monitor"
}
],
"category": "vendor",
"name": "Tenable Security"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-13034",
"product_status": {
"known_affected": [
"T049738",
"T002207",
"T027843",
"T050330",
"74185"
]
},
"release_date": "2026-01-06T23:00:00.000+00:00",
"title": "CVE-2025-13034"
},
{
"cve": "CVE-2025-14017",
"product_status": {
"known_affected": [
"T049738",
"T002207",
"T027843",
"T050330",
"74185"
]
},
"release_date": "2026-01-06T23:00:00.000+00:00",
"title": "CVE-2025-14017"
},
{
"cve": "CVE-2025-14524",
"product_status": {
"known_affected": [
"T049738",
"T002207",
"T027843",
"T050330",
"74185"
]
},
"release_date": "2026-01-06T23:00:00.000+00:00",
"title": "CVE-2025-14524"
},
{
"cve": "CVE-2025-14819",
"product_status": {
"known_affected": [
"T049738",
"T002207",
"T027843",
"T050330",
"74185"
]
},
"release_date": "2026-01-06T23:00:00.000+00:00",
"title": "CVE-2025-14819"
},
{
"cve": "CVE-2025-15079",
"product_status": {
"known_affected": [
"T049738",
"T002207",
"T027843",
"T050330",
"74185"
]
},
"release_date": "2026-01-06T23:00:00.000+00:00",
"title": "CVE-2025-15079"
},
{
"cve": "CVE-2025-15224",
"product_status": {
"known_affected": [
"T049738",
"T002207",
"T027843",
"T050330",
"74185"
]
},
"release_date": "2026-01-06T23:00:00.000+00:00",
"title": "CVE-2025-15224"
}
]
}
GHSA-7Q9P-CX8R-RH2Q
Vulnerability from github – Published: 2026-01-08 12:30 – Updated: 2026-01-08 15:31
VLAI?
Details
When doing SSH-based transfers using either SCP or SFTP, and setting the known_hosts file, libcurl could still mistakenly accept connecting to hosts not present in the specified file if they were added as recognized in the libssh global known_hosts file.
Severity ?
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-15079"
],
"database_specific": {
"cwe_ids": [
"CWE-297"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-08T10:15:47Z",
"severity": "MODERATE"
},
"details": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file.",
"id": "GHSA-7q9p-cx8r-rh2q",
"modified": "2026-01-08T15:31:25Z",
"published": "2026-01-08T12:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15079"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3477116"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2025-15079.html"
},
{
"type": "WEB",
"url": "https://curl.se/docs/CVE-2025-15079.json"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/01/07/6"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
FKIE_CVE-2025-15079
Vulnerability from fkie_nvd - Published: 2026-01-08 10:15 - Updated: 2026-01-20 14:50
Severity ?
Summary
When doing SSH-based transfers using either SCP or SFTP, and setting the
known_hosts file, libcurl could still mistakenly accept connecting to hosts
*not present* in the specified file if they were added as recognized in the
libssh *global* known_hosts file.
References
| URL | Tags | ||
|---|---|---|---|
| 2499f714-1537-4658-8207-48ae4bb9eae9 | https://curl.se/docs/CVE-2025-15079.html | Vendor Advisory, Patch | |
| 2499f714-1537-4658-8207-48ae4bb9eae9 | https://curl.se/docs/CVE-2025-15079.json | Vendor Advisory | |
| 2499f714-1537-4658-8207-48ae4bb9eae9 | https://hackerone.com/reports/3477116 | Exploit, Issue Tracking, Third Party Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2026/01/07/6 | Mailing List, Third Party Advisory, Patch |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7FEF1B43-51CF-47FA-8D6C-2411D9B3F9C1",
"versionEndExcluding": "8.18.0",
"versionStartIncluding": "7.58.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "When doing SSH-based transfers using either SCP or SFTP, and setting the\nknown_hosts file, libcurl could still mistakenly accept connecting to hosts\n*not present* in the specified file if they were added as recognized in the\nlibssh *global* known_hosts file."
}
],
"id": "CVE-2025-15079",
"lastModified": "2026-01-20T14:50:24.330",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2026-01-08T10:15:47.100",
"references": [
{
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"tags": [
"Vendor Advisory",
"Patch"
],
"url": "https://curl.se/docs/CVE-2025-15079.html"
},
{
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"tags": [
"Vendor Advisory"
],
"url": "https://curl.se/docs/CVE-2025-15079.json"
},
{
"source": "2499f714-1537-4658-8207-48ae4bb9eae9",
"tags": [
"Exploit",
"Issue Tracking",
"Third Party Advisory"
],
"url": "https://hackerone.com/reports/3477116"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory",
"Patch"
],
"url": "http://www.openwall.com/lists/oss-security/2026/01/07/6"
}
],
"sourceIdentifier": "2499f714-1537-4658-8207-48ae4bb9eae9",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-297"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…