CVE-2025-0665

libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.

libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.

libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.

libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.

libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.

libcurl would wrongly close the same eventfd file descriptor twice when taking down a connection channel after having completed a threaded name resolve.

When asked to use a .netrc file for credentials and to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. The fix was included previously as part of MGAA-2025-0004.

These are all security issues fixed in the curl-8.12.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for curl fixes the following issues:

Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).

Security issues fixed:

• CVE-2025-0665: eventfd double close can cause libcurl to act unreliably (bsc#1236589).
• CVE-2025-4947: QUIC certificate check is skipped with wolfSSL allows for MITM attacks (bsc#1243397).
• CVE-2025-5025: no QUIC certificate pinning with wolfSSL can lead to connections to impostor servers that are not easily noticed (bsc#1243706).
• CVE-2025-5399: bug in websocket code can cause libcurl to get trapped in an endless busy-loop when processing specially crafted packets (bsc#1243933).
• CVE-2024-6874: punycode conversions to/from IDN can leak stack content when libcurl is built to use the macidn IDN backend (bsc#1228260).
• CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in heap buffer (bsc#1249191).
• CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server (bsc#1249348).

Other issues fixed:

• Fix wrong return code when --retry is used (bsc#1249367).

  • tool_operate: fix return code when --retry is used but not triggered [b42776b]

• Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).

  • tool_getparam: fix --ftp-pasv [5f805ee]

• Fixed with version 8.14.1:

  • TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
  • websocket: add option to disable auto-pong reply.
  • huge number of bugfixes.

  Please see https://curl.se/ch/ for full changelogs.

This update for curl fixes the following issues:

Update to 8.12.1:

• Bugfixes:

  • asyn-thread: fix build with 'CURL_DISABLE_SOCKETPAIR'
  • asyn-thread: fix HTTPS RR crash
  • asyn-thread: fix the returned bitmask from Curl_resolver_getsock
  • asyn-thread: survive a c-ares channel set to NULL
  • cmake: always reference OpenSSL and ZLIB via imported targets
  • cmake: respect 'GNUTLS_CFLAGS' when detected via 'pkg-config'
  • cmake: respect 'GNUTLS_LIBRARY_DIRS' in 'libcurl.pc' and 'curl-config'
  • content_encoding: #error on too old zlib
  • imap: TLS upgrade fix
  • ldap: drop support for legacy Novell LDAP SDK
  • libssh2: comparison is always true because rc <= -1
  • libssh2: raise lowest supported version to 1.2.8
  • libssh: drop support for libssh older than 0.9.0
  • openssl-quic: ignore ciphers for h3
  • pop3: TLS upgrade fix
  • runtests: fix the disabling of the memory tracking
  • runtests: quote commands to support paths with spaces
  • scache: add magic checks
  • smb: silence '-Warray-bounds' with gcc 13+
  • smtp: TLS upgrade fix
  • tool_cfgable: sort struct fields by size, use bitfields for booleans
  • tool_getparam: add "TLS required" flag for each such option
  • vtls: fix multissl-init
  • wakeup_write: make sure the eventfd write sends eight bytes

Update to 8.12.0:

• Security fixes:

  • [bsc#1234068, CVE-2024-11053] curl could leak the password used for the first host to the followed-to host under certain circumstances.
  • [bsc#1232528, CVE-2024-9681] HSTS subdomain overwrites parent cache entry
  • [bsc#1236589, CVE-2025-0665] eventfd double close

• Changes:

  • curl: add byte range support to --variable reading from file
  • curl: make --etag-save acknowledge --create-dirs
  • getinfo: fix CURLINFO_QUEUE_TIME_T and add 'time_queue' var
  • getinfo: provide info which auth was used for HTTP and proxy
  • hyper: drop support
  • openssl: add support to use keys and certificates from PKCS#11 provider
  • QUIC: 0RTT for gnutls via CURLSSLOPT_EARLYDATA
  • vtls: feature ssls-export for SSL session im-/export

• Bugfixes:

  • altsvc: avoid integer overflow in expire calculation
  • asyn-ares: acknowledge CURLOPT_DNS_SERVERS set to NULL
  • asyn-ares: fix memory leak
  • asyn-ares: initial HTTPS resolve support
  • asyn-thread: use c-ares to resolve HTTPS RR
  • async-thread: avoid closing eventfd twice
  • cd2nroff: do not insist on quoted <> within backticks
  • cd2nroff: support "none" as a TLS backend
  • conncache: count shutdowns against host and max limits
  • content_encoding: drop support for zlib before 1.2.0.4
  • content_encoding: namespace GZIP flag constants
  • content_encoding: put the decomp buffers into the writer structs
  • content_encoding: support use of custom libzstd memory functions
  • cookie: cap expire times to 400 days
  • cookie: parse only the exact expire date
  • curl: return error if etag options are used with multiple URLs
  • curl_multi_fdset: include the shutdown connections in the set
  • curl_sha512_256: rename symbols to the curl namespace
  • curl_url_set.md: adjust the added-in to 7.62.0
  • doh: send HTTPS RR requests for all HTTP(S) transfers
  • easy: allow connect-only handle reuse with easy_perform
  • easy: make curl_easy_perform() return error if connection still there
  • easy_lock: use Sleep(1) for thread yield on old Windows
  • ECH: update APIs to those agreed with OpenSSL maintainers
  • GnuTLS: fix 'time_appconnect' for early data
  • HTTP/2: strip TE request header
  • http2: fix data_pending check
  • http2: fix value stored to 'result' is never read
  • http: ignore invalid Retry-After times
  • http_aws_sigv4: Fix invalid compare function handling zero-length pairs
  • https-connect: start next immediately on failure
  • lib: redirect handling by protocol handler
  • multi: fix…