The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2025-20090-1 advisory.

    - CVE-2025-9086: Fixed Out of bounds read for cookie path (bsc#1249191)
    - CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757)
    - CVE-2025-10148: Fixed predictable WebSocket mask (bsc#1249348)

    Other fixes:
    - tool_operate: fix return code when --retry is used but not       triggered (bsc#1249367)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1351 advisory.

    When asked to both use a `.netrc` file for credentials and to follow HTTPredirects, curl could leak the     password used for the first host to thefollowed-to host under certain circumstances.

    This flaw only manifests itself if the netrc file has an entry that matchesthe redirect target hostname     but the entry either omits just the password oromits both login and password. (CVE-2024-11053)

    When asked to use a `.netrc` file for credentials **and** to follow HTTPredirects, curl could leak the     password used for the first host to thefollowed-to host under certain circumstances.

    This flaw only manifests itself if the netrc file has a `default` entry thatomits both login and password.
    A rare circumstance. (CVE-2025-0167)

    predictable WebSocket mask

    NOTE: https://curl.se/docs/CVE-2025-10148.htmlNOTE: Fixed by:
    https://github.com/curl/curl/commit/84db7a9eae8468c0445b15aa806fa7fa806fa0f2 (curl-8_16_0)     (CVE-2025-10148)

    curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed     and missed host verification mechanisms.

    This prevents curl from detecting MITM attackers and more. (CVE-2025-10966)

    Out of bounds read for cookie path

    NOTE: https://curl.se/docs/CVE-2025-9086.htmlNOTE: Introduced with:
    https://github.com/curl/curl/commit/f24dc09d209a2f91ca38d854f0c15ad93f3d7e2d (curl-7_31_0)NOTE: Fixed by:
    https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb62b45dd37711300 (rc-8_16_0-1) (CVE-2025-9086)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8062-1 advisory.

    It was discovered that curl incorrectly handled cookies when redirected from secure to insecure     connections. An attacker could possibly use this issue to cause a denial of service, or obtain sensitive     information. This issue only affected Ubuntu 25.10. (CVE-2025-9086)

    Calvin Ruocco discovered that curl did not properly handle WebSocket communications under certain     circumstances. A malicious server could possibly use this issue to poison proxy caches with malicious     content. This issue only affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-10148)

    Stanislav Fort discovered that wcurl did not properly handle URLs with certain encoded characters. If a     user were tricked into processing a specially crafted URL, an attacker could possibly use this issue to     write files outside the intended directory. This issue only affected Ubuntu 25.10. (CVE-2025-11563)

    Stanislav Fort discovered that curl did not properly validate pinned public keys under certain     circumstances. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack.
    This issue only affected Ubuntu 25.10.(CVE-2025-13034)

    Stanislav Fort discovered that curl did not properly manage TLS options when performing LDAP over TLS     transfers in multi-threaded environments. Under certain circumstances, certificate verification could be     unintentionally and unknowingly disabled. (CVE-2025-14017)

    It was discovered that curl incorrectly handled Oauth2 bearer tokens when following redirects. A remote     attacker could possibly use this issue to obtain authentication credentials. (CVE-2025-14524)

    Stanislav Fort discovered that curl did not properly validate TLS certificates when reusing connections. A     remote attacker could possibly use this issue to bypass expected certificate verification. This issue only     affected Ubuntu 24.04 LTS and Ubuntu 25.10. (CVE-2025-14819)

    Harry Sintonen discovered that curl did not properly validate SSH host keys when performing SSH-based file     transfers. This issue could lead to unintended bypass of custom known_hosts file. This issue only affected     Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15079)

    Harry Sintonen discovered that curl built with libssh did not properly handle authentication when     performing SSH-based file transfers. This could result in unintended authentication operations. This issue     only affected Ubuntu 22.04 LTS and Ubuntu 24.04 LTS. (CVE-2025-15224)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-97ae15dc56 advisory.

    - Fix Out of bounds read for cookie path (CVE-2025-9086)
    - Fix predictable WebSocket mask (CVE-2025-10148)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:03267-1 advisory.

    Security issues fixed:

    - CVE-2025-9086: bug in patch comparison logic when processing cookies can lead to out-of-bounds read in     heap buffer       (bsc#1249191).
    - CVE-2025-10148: predictable websocket mask can lead to proxy cache poisoning by malicious server     (bsc#1249348).

    Other issues fixed:

    - Fix the --ftp-pasv option in curl v8.14.1 (bsc#1246197).
      * tool_getparam: fix --ftp-pasv [5f805ee]

    - Update to version 8.14.1 (jsc#PED-13055, jsc#PED-13056).
      * TLS: add CURLOPT_SSL_SIGNATURE_ALGORITHMS and --sigalgs.
      * websocket: add option to disable auto-pong reply.
      * huge number of bugfixes.

      Please see https://curl.se/ch/ for full changelogs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

An update of the curl package has been released.

The version of Tenable Identity Exposure (formerly Tenable.ad) installed on the remote host is prior to 3.77.14. It therefore contains vulnerable versions of third-party components (.NET, SQL Server, and curl). Tenable has upgraded these components to address the potential impact of the issues, including the following:

  - Inconsistent interpretation of HTTP requests ('HTTP request/response smuggling') in ASP.NET Core allows an     authorized attacker to bypass a security feature over a network. (CVE-2025-55315)

  - Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.     (CVE-2025-49718)

  - A cookie is set using the `secure` keyword for `https://target`. Curl is redirected to or otherwise made to speak     with `http://target` (same hostname, but using clear text HTTP) using the same cookie set. The same cookie name is     set - but with just a slash as path (`path='/'`). Since this site is not secure, the cookie should just be     ignored. A bug in the path comparison logic makes curl read outside a heap buffer boundary. The bug either causes a     crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the     contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following     the single-byte allocation that holds the path. (CVE-2025-9086)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
277017	openSUSE 16 Security Update : curl (openSUSE-SU-2025-20090-1)	Nessus	SuSE Local Security Checks	2025/12/2	2026/3/3	medium
282370	Amazon Linux 2023 : curl, curl-minimal, libcurl (ALAS2023-2025-1351)	Nessus	Amazon Linux Local Security Checks	2026/1/8	2026/1/21	medium
300431	Ubuntu 22.04 LTS / 24.04 LTS / 25.10 : curl vulnerabilities (USN-8062-1)	Nessus	Ubuntu Local Security Checks	2026/3/3	2026/4/30	medium
265679	Fedora 42 : curl (2025-97ae15dc56)	Nessus	Fedora Local Security Checks	2025/9/20	2026/1/21	medium
265417	SUSE SLED15 / SLES15 Security Update : curl (SUSE-SU-2025:03267-1)	Nessus	SuSE Local Security Checks	2025/9/19	2026/1/21	medium
271953	Photon OS 5.0: Curl PHSA-2025-5.0-0660	Nessus	PhotonOS Local Security Checks	2025/10/29	2026/10/13	medium
275306	Photon OS 4.0: Curl PHSA-2025-4.0-0903	Nessus	PhotonOS Local Security Checks	2025/11/13	2026/11/2	medium
272257	Tenable Identity Exposure < 3.77.14 Multiple Vulnerabilities (TNS-2025-23)	Nessus	Misc.	2025/11/4	2025/11/4	critical

検出

プラグインの検索

medium

medium

medium

medium

medium

medium

medium

critical