Fedora 42 Update: curl-8.11.1-6.fc42
Fedora 43 Update: libssh-0.11.3-1.fc43
[SECURITY] Fedora 42 Update: curl-8.11.1-6.fc42
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-97ae15dc56
2025-09-20 00:54:38.875793+00:00
--------------------------------------------------------------------------------
Name : curl
Product : Fedora 42
Version : 8.11.1
Release : 6.fc42
URL : https://curl.se/
Summary : A utility for getting files from remote servers (FTP, HTTP, and others)
Description :
curl is a command line tool for transferring data with URL syntax, supporting
FTP, FTPS, HTTP, HTTPS, SCP, SFTP, TFTP, TELNET, DICT, LDAP, LDAPS, FILE, IMAP,
SMTP, POP3 and RTSP. curl supports SSL certificates, HTTP POST, HTTP PUT, FTP
uploading, HTTP form based upload, proxies, cookies, user+password
authentication (Basic, Digest, NTLM, Negotiate, kerberos...), file transfer
resume, proxy tunneling and a busload of other useful tricks.
--------------------------------------------------------------------------------
Update Information:
Fix Out of bounds read for cookie path (CVE-2025-9086)
Fix predictable WebSocket mask (CVE-2025-10148)
--------------------------------------------------------------------------------
ChangeLog:
* Wed Sep 17 2025 Jan Macku [jamacku@redhat.com] - 8.11.1-6
- Fix Out of bounds read for cookie path (CVE-2025-9086)
- Fix predictable WebSocket mask (CVE-2025-10148)
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2394853 - CVE-2025-10148 curl: predictable WebSocket mask [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2394853
[ 2 ] Bug #2394884 - CVE-2025-9086 curl: Curl out of bounds read for cookie path [fedora-42]
https://bugzilla.redhat.com/show_bug.cgi?id=2394884
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-97ae15dc56' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
[SECURITY] Fedora 43 Update: libssh-0.11.3-1.fc43
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2025-50a98965b5
2025-09-20 00:18:58.768242+00:00
--------------------------------------------------------------------------------
Name : libssh
Product : Fedora 43
Version : 0.11.3
Release : 1.fc43
URL : http://www.libssh.org
Summary : A library implementing the SSH protocol
Description :
The ssh library was designed to be used by programmers needing a working SSH
implementation by the mean of a library. The complete control of the client is
made by the programmer. With libssh, you can remotely execute programs, transfer
files, use a secure and transparent tunnel for your remote programs. With its
Secure FTP implementation, you can play with remote files easily, without
third-party programs others than libcrypto (from openssl).
--------------------------------------------------------------------------------
Update Information:
New upstream release fixing the following security weaknesses (CVE-2025-8114,
CVE-2025-8277)
--------------------------------------------------------------------------------
ChangeLog:
* Tue Sep 9 2025 Jakub Jelen [jjelen@redhat.com] - 0.11.3-1
- New upstream release fixing the following security weaknesses:
- CVE-2025-8114: Fix NULL pointer dereference after allocation failure
- CVE-2025-8277: Fix memory leak of ephemeral key pair during repeated wrong KEX
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #2394021 - libssh-0.11.3 is available
https://bugzilla.redhat.com/show_bug.cgi?id=2394021
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2025-50a98965b5' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
--
