CVE-2025-0725
גבוהה 7.3
תיאור (מקור, אנגלית)
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
מדדים
- CVSS 3.1
-
7.3 (HIGH)
מקור הציון: CNA
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L - EPSS — סבירות ניצול
- 2% (אחוזון 100) נכון ל-16/10/2026
- CWE
- CWE-120
מוצרים מושפעים
netapp: hci baseboard management controller; netapp: hci h610s firmware; netapp: hci h610s; netapp: hci h610c firmware; netapp: hci h610c; netapp: hci h615c firmware; netapp: hci h615c; netapp: solidfire \& hci management node; netapp: solidfire \& hci storage node; haxx: curl; haxx: libcurl; zlib: zlib
קישורים
- https://curl.se/docs/CVE-2025-0725.html Vendor Advisory
- https://curl.se/docs/CVE-2025-0725.json Vendor Advisory
- https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7 Patch
- https://hackerone.com/reports/2956023 ExploitIssue Tracking
- http://www.openwall.com/lists/oss-security/2025/02/05/3 Mailing List
- http://www.openwall.com/lists/oss-security/2025/02/06/2 Mailing List
- http://www.openwall.com/lists/oss-security/2025/02/06/4 Mailing List
- https://security.netapp.com/advisory/ntap-20250306-0009/ Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html