CVE-2025-0725: gzip integer overflow
Published Feb 5, 2025
·Updated
gzip integer overflow
Other sources
When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the CURLOPTACCEPTENCODING option, using zlib 1.2.0.3 or older, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.
— MITRE
Affected Software
19 affected componentsFixes available
curl libcurl<1.2.0.3
NetApp Hci Baseboard Management Controller
All of the following
NetApp Hci H610s Firmware
NetApp Hci H610s
All of the following
NetApp Hci H610c Firmware
NetApp Hci H610c
All of the following
NetApp Hci H615c Firmware
NetApp Hci H615c
NetApp Solidfire \& Hci Management Node
NetApp Solidfire \& Hci Storage Node
All of the following
Any of the following
haxx curl>=7.10.5<8.12.0
haxx libcurl>=7.10.5<8.12.0
zlib zlib<=1.2.0.3
Microsoft cbl2 mysql 8.0.41-1
Microsoft azl3 mysql 8.0.40-6
Microsoft cbl2 mysql 8.0.40-4
Microsoft azl3 curl 8.11.1-3
Microsoft cbl2 mysql 8.0.41-1
Microsoft azl3 mysql 8.0.41-1
Remediation
Event History
Feb 5, 2025
CVE Published
via MITRE·09:18 AM
Data Sourced
via MITRE·09:18 AM
DescriptionWeakness
Data Sourced
via NVD·10:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Feb 14, 2025
Data Sourced
via Microsoft·08:00 AM
DescriptionSeverityWeakness
Data Sourced
via Microsoft·08:00 AM
Affected Software
Updated
via Microsoft·08:00 AM
Affected Software
Updated
via Microsoft·08:00 AM
SeverityAffected Software
Updated
via Microsoft·08:00 AM
DescriptionSeverity
Frequently Asked Questions
1
What is the severity of CVE-2025-0725?
CVE-2025-0725 has a critical severity due to the potential for an integer overflow leading to a buffer overflow.
2
How do I fix CVE-2025-0725?
To fix CVE-2025-0725, upgrade your libcurl to a version later than 1.2.0.3.
3
What versions of libcurl are affected by CVE-2025-0725?
CVE-2025-0725 affects libcurl versions 1.2.0.3 and older.
4
What security risks does CVE-2025-0725 pose?
CVE-2025-0725 can allow attackers to execute arbitrary code through a buffer overflow exploit.
5
Is it safe to use libcurl versions newer than 1.2.0.3 in relation to CVE-2025-0725?
Yes, using versions of libcurl newer than 1.2.0.3 mitigates the vulnerability identified in CVE-2025-0725.