libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If given an syntactically incorrect field, the parser might end up using -1 for the length of the *time fraction*, leading to a `strlen()` getting performed on a pointer to a heap buffer area that is not (purposely) null terminated.
This flaw most likely leads to a crash, but can also lead to heap contents getting returned to the application when [CURLINFO_CERTINFO](https://curl.se/libcurl/c/CURLINFO_CERTINFO.html) is used.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade mysql-serverUpgrade mysql-develUpgrade mysql-errmsgUpgrade mecabUpgrade mysql-testUpgrade mysqlUpgrade mecab-develUpgrade mysql-commonUpgrade mecab-ipadic-EUCJPUpgrade mysql-libsUpgrade mecab-ipadic | Feb 21, 2025 | Jul 31, 2024 |
| Alpine Linux | — | Upgrade curl | Oct 1, 2024 | Jul 31, 2024 |
| Amazon Linux Ami 2 | — | Upgrade ecs-service-connect-agent | Nov 14, 2024 | Jul 31, 2024 |
| Amazon_linux_2023 | — | Upgrade ecs-service-connect-agent | Feb 17, 2025 | Jul 31, 2024 |
| Apple Osx Curl | — | Upgrade macOS to the latest version | Dec 15, 2025 | Dec 12, 2025 |
| Debian | — | Upgrade curl | Sep 2, 2024 | Jul 31, 2024 |
| Huawei Euleros 2_0_sp10 | — | Upgrade libcurlUpgrade curl | Nov 11, 2024 | Jul 31, 2024 |
| Huawei Euleros 2_0_sp11 | — | Upgrade curlUpgrade libcurl | Oct 9, 2024 | Jul 31, 2024 |
| Huawei Euleros 2_0_sp12 | — | Upgrade libcurlUpgrade curl | Nov 5, 2024 | Jul 31, 2024 |
| Huawei Euleros 2_0_sp9 | — | Upgrade curlUpgrade libcurl | Nov 11, 2024 | Jul 31, 2024 |
| Oracle Missing Cpu Oct 2024 | — | Apply the October 2024 Critical Patch Update (CPU) for Oracle Database | Oct 18, 2024 | Jul 31, 2024 |
| Oracle Mysql | — | Upgrade to MySQL version 8.0.40Upgrade to MySQL version 9.1.0Upgrade to MySQL version 8.4.3 | Oct 23, 2024 | Jul 31, 2024 |
| Oracle_linux | — | Upgrade mysqlUpgrade mecab-develUpgrade mecabUpgrade mysql-serverUpgrade mysql-develUpgrade mysql-testUpgrade mecab-ipadicUpgrade mysql-errmsgUpgrade mysql-commonUpgrade mecab-ipadic-EUCJPUpgrade mysql-libs | Feb 25, 2025 | Jul 31, 2024 |
| Redhat_linux | — | Upgrade mysql-serverUpgrade mysql-libsUpgrade mysql-server-debuginfoUpgrade mecab-ipadic-EUCJPUpgrade mecab-debugsourceUpgrade mysql-debuginfoUpgrade mecab-develUpgrade mysql-develUpgrade mysql-test-debuginfoUpgrade mysql-libs-debuginfoUpgrade mysql-commonUpgrade mysql-debugsourceUpgrade mysqlNo solution existsUpgrade mecab-debuginfoUpgrade mecabUpgrade mysql-devel-debuginfoUpgrade mysql-testUpgrade mecab-ipadicUpgrade mysql-errmsg | Feb 20, 2025 | Jul 31, 2024 |
| Rocky_linux | — | Upgrade mecab-ipadic-EUCJPUpgrade mysql-test-debuginfoUpgrade mecab-debuginfoUpgrade mysql-serverUpgrade mysql-testUpgrade mysql-libsUpgrade mysql-develUpgrade mysql-errmsgUpgrade mysql-devel-debuginfoUpgrade mysql-commonUpgrade mysql-libs-debuginfoUpgrade mysqlUpgrade mecab-ipadicUpgrade mysql-debugsourceUpgrade mecab-debugsourceUpgrade mysql-server-debuginfoUpgrade mecab-develUpgrade mysql-debuginfoUpgrade mecab | Feb 27, 2025 | Jul 31, 2024 |
| Splunk | — | Upgrade Splunk Enterprise to version 9.3.5Upgrade Splunk Enterprise to version 9.2.7Upgrade Splunk Enterprise to version 9.4.3Upgrade Splunk Enterprise to version 9.1.10 | Jul 30, 2026 | Jul 31, 2024 |
| Suse | — | Upgrade libcurl4Upgrade curlUpgrade libcurl-develUpgrade curl-zsh-completionUpgrade libcurl4-32bitUpgrade libcurl-mini4Upgrade libcurl-devel-32bitUpgrade libcurl-devel-doc | Aug 7, 2024 | Jul 31, 2024 |
| Ubuntu | — | Upgrade curl (Ubuntu Pro)Upgrade libcurl3-gnutlsUpgrade libcurl4t64Upgrade curlUpgrade libcurl3t64-gnutlsUpgrade libcurl3 (Ubuntu Pro)Upgrade libcurl3-nssUpgrade libcurl4Upgrade libcurl3-nss (Ubuntu Pro)Upgrade libcurl4 (Ubuntu Pro)Upgrade libcurl3-gnutls (Ubuntu Pro) | Aug 6, 2024 | Jul 31, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Jul 31, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub