CVE-2025-0725
CVE-2025-0725 · gzip integer overflow
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
CVSS 7.3 · Élevée · EPSS 1,8% · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: system
Produits et versions concernés
curl
- Versions du logiciel
- ≥ 8.11.1, ≤ 8.11.1: Concernée (semver)
- ≥ 8.11.0, ≤ 8.11.0: Concernée (semver)
- ≥ 8.10.1, ≤ 8.10.1: Concernée (semver)
- ≥ 8.10.0, ≤ 8.10.0: Concernée (semver)
- ≥ 8.9.1, ≤ 8.9.1: Concernée (semver)
- ≥ 8.9.0, ≤ 8.9.0: Concernée (semver)
- ≥ 8.8.0, ≤ 8.8.0: Concernée (semver)
- ≥ 8.7.1, ≤ 8.7.1: Concernée (semver)
- ≥ 8.7.0, ≤ 8.7.0: Concernée (semver)
- ≥ 8.6.0, ≤ 8.6.0: Concernée (semver)
- ≥ 8.5.0, ≤ 8.5.0: Concernée (semver)
- ≥ 8.4.0, ≤ 8.4.0: Concernée (semver)
- ≥ 8.3.0, ≤ 8.3.0: Concernée (semver)
- ≥ 8.2.1, ≤ 8.2.1: Concernée (semver)
- ≥ 8.2.0, ≤ 8.2.0: Concernée (semver)
- ≥ 8.1.2, ≤ 8.1.2: Concernée (semver)
- ≥ 8.1.1, ≤ 8.1.1: Concernée (semver)
- ≥ 8.1.0, ≤ 8.1.0: Concernée (semver)
- ≥ 8.0.1, ≤ 8.0.1: Concernée (semver)
- ≥ 8.0.0, ≤ 8.0.0: Concernée (semver)
- ≥ 7.88.1, ≤ 7.88.1: Concernée (semver)
- ≥ 7.88.0, ≤ 7.88.0: Concernée (semver)
- ≥ 7.87.0, ≤ 7.87.0: Concernée (semver)
- ≥ 7.86.0, ≤ 7.86.0: Concernée (semver)
- ≥ 7.85.0, ≤ 7.85.0: Concernée (semver)
- ≥ 7.84.0, ≤ 7.84.0: Concernée (semver)
- ≥ 7.83.1, ≤ 7.83.1: Concernée (semver)
- ≥ 7.83.0, ≤ 7.83.0: Concernée (semver)
- ≥ 7.82.0, ≤ 7.82.0: Concernée (semver)
- ≥ 7.81.0, ≤ 7.81.0: Concernée (semver)
- ≥ 7.80.0, ≤ 7.80.0: Concernée (semver)
- ≥ 7.79.1, ≤ 7.79.1: Concernée (semver)
- ≥ 7.79.0, ≤ 7.79.0: Concernée (semver)
- ≥ 7.78.0, ≤ 7.78.0: Concernée (semver)
- ≥ 7.77.0, ≤ 7.77.0: Concernée (semver)
- ≥ 7.76.1, ≤ 7.76.1: Concernée (semver)
- ≥ 7.76.0, ≤ 7.76.0: Concernée (semver)
- ≥ 7.75.0, ≤ 7.75.0: Concernée (semver)
- ≥ 7.74.0, ≤ 7.74.0: Concernée (semver)
- ≥ 7.73.0, ≤ 7.73.0: Concernée (semver)
- ≥ 7.72.0, ≤ 7.72.0: Concernée (semver)
- ≥ 7.71.1, ≤ 7.71.1: Concernée (semver)
- ≥ 7.71.0, ≤ 7.71.0: Concernée (semver)
- ≥ 7.70.0, ≤ 7.70.0: Concernée (semver)
- ≥ 7.69.1, ≤ 7.69.1: Concernée (semver)
Aucun correctif publié
curl Debian:12
- Versions du logiciel
- 7.88.1-10
- 7.88.1-10+deb12u1
- 7.88.1-10+deb12u11
- 7.88.1-10+deb12u12
- 7.88.1-10+deb12u13
- 7.88.1-10+deb12u14
- 7.88.1-10+deb12u15
- 7.88.1-10+deb12u1~bpo11+1
- 7.88.1-10+deb12u2
- 7.88.1-10+deb12u3
- 7.88.1-10+deb12u3~bpo11+1
- 7.88.1-10+deb12u4
- 7.88.1-10+deb12u5
- 7.88.1-10+deb12u5~bpo11+1
- 7.88.1-10+deb12u6
- 7.88.1-10+deb12u6~bpo11+1
- 7.88.1-10+deb12u7
- 7.88.1-10+deb12u8
- 7.88.1-10+deb12u9
- 7.88.1-11
- 8.0.1-1~exp1
- 8.10.0-1
- 8.10.0-2
- 8.10.1-1
- 8.10.1-1~bpo12+1
- 8.10.1-2
- 8.11.0-1
- 8.11.1-1
- 8.11.1-1~bpo12+1
- 8.12.0+git20250209.89ed161+ds-1
- 8.12.0+git20250209.89ed161+ds-1~bpo12+1
- 8.12.1-1
- 8.12.1-2
- 8.12.1-2~bpo12+1
- 8.12.1-3
- 8.12.1-3~bpo12+1
- 8.13.0-1
- 8.13.0-1+exp1
- 8.13.0-2
- 8.13.0-2+exp1
- 8.13.0-3
- 8.13.0-4
- 8.13.0-4+exp1
- 8.13.0-5
- 8.13.0-5+exp1
- 8.13.0-5~bpo12+1
- 8.13.0~rc-1~exp1
- 8.13.0~rc-1~exp2
- 8.13.0~rc2-1
- 8.13.0~rc2-2
- 8.13.0~rc3-1
- 8.13.0~rc3-1+exp1
- 8.14.0-1
- 8.14.0-1+exp1
- 8.14.0~rc1-1+exp1
- 8.14.0~rc2-1+exp1
- 8.14.0~rc3-1+exp1
- 8.14.1-1
- 8.14.1-1~bpo12+1
- 8.14.1-2
- 8.14.1-2+exp1
- 8.14.1-2~bpo12+1
- 8.15.0-1
- 8.15.0-1~bpo13+1
- 8.15.0-1~exp1
- 8.15.0~rc1-1exp1
- 8.15.0~rc2-1~exp1
- 8.15.0~rc3-1~exp1
- 8.16.0-1
- 8.16.0-1+exp1
- 8.16.0-1~bpo13+1
- 8.16.0-2
- 8.16.0-3
- 8.16.0-4
- 8.16.0-4~bpo13+1
- 8.16.0~rc1-1~exp1
- 8.16.0~rc2-1
- 8.16.0~rc2-2
- 8.16.0~rc3-1
- 8.17.0-1
- 8.17.0-2
- 8.17.0-3
- 8.17.0~rc1-1~exp1
- 8.17.0~rc2-1
- 8.17.0~rc3-1
- 8.18.0-1
- 8.18.0-1~bpo13+1
- 8.18.0-2
- 8.18.0~rc1-1+exp1
- 8.18.0~rc2-1
- 8.18.0~rc3-1
- 8.19.0-1
- 8.19.0-1+exp1
- 8.19.0-1~bpo13+1
- 8.19.0-2
- 8.19.0-3
- 8.19.0-3+exp1
- 8.19.0-3+exp2
- 8.19.0~rc1-1~exp1
- 8.19.0~rc2-1
- 8.19.0~rc2-2
- 8.19.0~rc3-1
- 8.2.1-1
- 8.2.1-2
- 8.2.1-2~bpo12+1
- 8.20.0-1
- 8.20.0-1+exp
- 8.20.0-2
- 8.20.0-2+exp1
- 8.20.0-2~bpo13+1
- 8.20.0-3
- 8.20.0-4
- 8.20.0-5
- 8.20.0-5~bpo13+1
- 8.20.0~rc1-1+exp1
- 8.20.0~rc1-1+exp2
- 8.20.0~rc1-1+exp3
- 8.20.0~rc2-1
- 8.20.0~rc2-1+exp1
- 8.20.0~rc3-1
- 8.20.0~rc3-1+exp1
- 8.21.0-1
- 8.21.0-1+exp1
- 8.21.0-2
- 8.21.0-2+exp1
- 8.21.0-2~bpo13+1
- 8.21.0~rc1-1+exp1
- 8.21.0~rc2-1
- 8.21.0~rc2-1+exp1
- 8.21.0~rc3-1
- 8.21.0~rc3-1+exp1
- 8.22.0-1
- 8.22.0-1+exp1
- 8.22.0~rc2-1
- 8.22.0~rc2-2
- 8.22.0~rc3-1
- 8.22.0~rc3-1+exp1
- 8.23.0-1
- 8.23.0~rc1-1
- 8.23.0~rc1-2
- 8.23.0~rc2-1
- 8.23.0~rc2-1+exp1
- 8.23.0~rc3-1
- 8.23.0~rc3-1+exp1
- 8.3.0-1
- 8.3.0-2
- 8.3.0-2~bpo12+1
- 8.3.0-2~exp1
- 8.3.0-3
- 8.4.0-1
- 8.4.0-2
- 8.4.0-2~bpo12+1
- 8.5.0-1
- 8.5.0-1+exp1
- 8.5.0-2
- 8.5.0-2+exp1
- 8.5.0-2~bpo12+1
- 8.6.0-1
- 8.6.0-1.1
- 8.6.0-2
- 8.6.0-3
- 8.6.0-3.1
- 8.6.0-3.1~exp1
- 8.6.0-3.1~exp2
- 8.6.0-3.2
- 8.6.0-4
- 8.7.1-1
- 8.7.1-1+exp1
- 8.7.1-2
- 8.7.1-3
- 8.7.1-4
- 8.7.1-5
- 8.7.1-5+exp1
- 8.7.1-5~bpo12+1
- 8.8.0-1
- 8.8.0-1+exp1
- 8.8.0-1+exp2
- 8.8.0-1~bpo12+1
- 8.8.0-2
- 8.8.0-3
- 8.8.0-4
- 8.9.0-1
- 8.9.0-2
- 8.9.0-3
- 8.9.1-1
- 8.9.1-2
- 8.9.1-2~bpo12+1
- Plages de versions concernées
- ECOSYSTEM: (−∞, +∞)
Aucun correctif publié
curl Debian:13
- Plages de versions concernées
- ECOSYSTEM: < 8.12.0+git20250209.89ed161+ds-1
Mettez à jour vers 8.12.0+git20250209.89ed161+ds-1
curl Debian:14
- Plages de versions concernées
- ECOSYSTEM: < 8.12.0+git20250209.89ed161+ds-1
Mettez à jour vers 8.12.0+git20250209.89ed161+ds-1
Sources originales
- https://curl.se/docs/CVE-2025-0725.json
- https://curl.se/docs/CVE-2025-0725.html
- https://hackerone.com/reports/2956023
- http://www.openwall.com/lists/oss-security/2025/02/05/3
- http://www.openwall.com/lists/oss-security/2025/02/06/2
- http://www.openwall.com/lists/oss-security/2025/02/06/4
- https://security.netapp.com/advisory/ntap-20250306-0009/
- https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://cert-portal.siemens.com/productcert/html/ssa-089022.html
- https://nvd.nist.gov/vuln/detail/CVE-2025-0725