NetApp SolidFire & HCI Storage Node

When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.

Published: 2025-02-05T09:18:20.468Z
Updated: 2025-06-12T16:04:29.956Z

When asked to use a `.netrc` file for credentials **and** to follow HTTP redirects, curl could leak the password used for the first host to the followed-to host under certain circumstances. This flaw only manifests itself if the netrc file has a `default` entry that omits both login and password. A rare circumstance.

Published: 2025-02-05T09:15:06.891Z
Updated: 2025-03-07T00:10:48.290Z

An issue was discovered in libexpat before 2.6.4. There is a crash within the XML_ResumeParser function because XML_StopParser can stop/suspend an unstarted parser.

Published: 2024-10-27T00:00:00.000Z
Updated: 2025-04-30T20:03:17.594Z

In libxml2 2.11 before 2.11.9, 2.12 before 2.12.9, and 2.13 before 2.13.3, the SAX parser can produce events for external entities even if custom SAX handlers try to override entity content (by setting "checked"). This makes classic XXE attacks possible.

Published: 2024-12-23T00:00:00.000Z
Updated: 2025-02-28T13:07:30.165Z

In the Linux kernel, the following vulnerability has been resolved: NFSD: Fix nfsd4_encode_fattr4() crasher Ensure that args.acl is initialized early. It is used in an unconditional call to kfree() on the way out of nfsd4_encode_fattr4().

Published: 2024-05-30T15:35:51.033Z
Updated: 2026-05-11T20:17:47.772Z