SUSE update for curl
| Risk | Low |
| Patch available | YES |
| Number of vulnerabilities | 1 |
| CVE-ID | CVE-2025-11563 |
| CWE-ID | CWE-22 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Basesystem Module Operating systems & Components / Operating system SUSE Linux Enterprise Real Time 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications 15 Operating systems & Components / Operating system SUSE Linux Enterprise Server 15 Operating systems & Components / Operating system SUSE Linux Enterprise Desktop 15 Operating systems & Components / Operating system libcurl4-32bit-debuginfo Operating systems & Components / Operating system package or component libcurl4-32bit Operating systems & Components / Operating system package or component libcurl4 Operating systems & Components / Operating system package or component libcurl4-debuginfo Operating systems & Components / Operating system package or component curl Operating systems & Components / Operating system package or component curl-debuginfo Operating systems & Components / Operating system package or component curl-debugsource Operating systems & Components / Operating system package or component libcurl-devel Operating systems & Components / Operating system package or component |
| Vendor | SUSE |
Security Bulletin
This security bulletin contains one low risk vulnerability.
1) Path traversal
EUVDB-ID: #VU118723
Risk:
CVSSv4.0: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N/E:U]
CVE-ID: CVE-2025-11563
CWE-ID:
CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform directory traversal attacks.
The vulnerability exists due to input validation error when processing percent-encoded slashes (/ or \\) in wcurl. A remote attacker can trick the application into saving the output file outside of the current directory without the user explicitly asking for it.
MitigationUpdate the affected package curl to the latest version.
Vulnerable software versionsBasesystem Module: 15-SP7
SUSE Linux Enterprise Real Time 15: SP7
SUSE Linux Enterprise Server for SAP Applications 15: SP7
SUSE Linux Enterprise Server 15: SP7
SUSE Linux Enterprise Desktop 15: SP7
libcurl4-32bit-debuginfo: before 8.14.1-150700.7.5.1
libcurl4-32bit: before 8.14.1-150700.7.5.1
libcurl4: before 8.14.1-150700.7.5.1
libcurl4-debuginfo: before 8.14.1-150700.7.5.1
curl: before 8.14.1-150700.7.5.1
curl-debuginfo: before 8.14.1-150700.7.5.1
curl-debugsource: before 8.14.1-150700.7.5.1
libcurl-devel: before 8.14.1-150700.7.5.1
CPE2.3- cpe:2.3:o:suse:basesystem_module:15-SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_real_time_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_for_sap_applications_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_server_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:o:suse:suse_linux_enterprise_desktop_15:SP7:*:*:*:*:*:*:*
- cpe:2.3:a:suse:libcurl4-32bit-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcurl4-32bit:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcurl4:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcurl4-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:curl:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:curl-debuginfo:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:curl-debugsource:*:*:*:*:*:suse_linux:*:*
- cpe:2.3:a:suse:libcurl-devel:*:*:*:*:*:suse_linux:*:*
https://www.suse.com/support/update/announcement/2025/suse-su-20254300-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
