CVE-2025-0725

Katalog CVE

CVSS 7.3 · High EPSS 1,3%

Kerentanan Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') pada netapp hci baseboard management controller, netapp hci h610s firmware +6 lainnya. Skor CVSS 3.1 7.3 (High) menurut CISA ADP.

Deskripsi (NVD)

When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

Rincian

Terbit di NVD

5 Februari 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.3 (High), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 68,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://curl.se/docs/CVE-2025-0725.html advisory vendor
• https://curl.se/docs/CVE-2025-0725.json advisory vendor
• https://github.com/curl/curl/commit/76f83f0db23846e254d940ec7 patch
• https://security.netapp.com/advisory/ntap-20250306-0009/ advisory pihak ketiga
• https://hackerone.com/reports/2956023 exploit · issue tracking
• http://www.openwall.com/lists/oss-security/2025/02/05/3 mailing list
• http://www.openwall.com/lists/oss-security/2025/02/06/2 mailing list
• http://www.openwall.com/lists/oss-security/2025/02/06/4 mailing list