SUSE-SU-2025:03173-1

Advisory lineage Upstream: 2 Downstream: 0
Published: 11 Sept 2025, 12:55
Last modified:23 Mar 2026, 04:48

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

11 Sept 2025, 12:55
Published
Vulnerability first disclosed
23 Mar 2026, 04:48
Last Modified
Vulnerability information updated

Description

Security update for curl This update for curl fixes the following issues: - CVE-2025-9086: bug in path comparison logic when processing cookies can lead to out-of-bounds read in heap buffer (bsc#1249191). - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).

Affected Systems

  • suse•curl&distro=SUSE Linux Enterprise Server 12 SP5-LTSS

    < 8.0.1-11.108.1

  • suse•curl&distro=SUSE Linux Enterprise Server LTSS Extended Security 12 SP5

    < 8.0.1-11.108.1

References (5)