Detections
Analytics

EulerOS Virtualization 2.10.1 : curl (EulerOS-SA-2026-1109)

high Nessus Plugin ID 297359

Synopsis

The remote EulerOS Virtualization host is missing multiple security updates.

Description

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

 curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms.

 This prevents curl from detecting MITM attackers and more.(CVE-2025-10966)

 When libcurl is asked to perform automatic gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option,
 **using zlib 1.2.0.3 or older**, an attacker-controlled integer overflow would make libcurl perform a buffer overflow.(CVE-2025-0725)

 1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with just a slash as path (`path='/'`).Since this site is not secure, the cookie *should* just be ignored.
 4. A bug in the path comparison logic makes curl read outside a heap buffer boundary

 The bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.

 The presumed and correct behavior would be to plainly ignore the second set of the cookie since it was already set as secure on a secure host so overriding it on an insecure host should not be okay.(CVE-2025-9086)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization curl security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected curl packages.

See Also

http://www.nessus.org/u?885d8c32

Plugin Details

Severity: High

ID: 297359

File Name: EulerOS_SA-2026-1109.nasl

Version: 1.1

Type: local

Published: 1/31/2026

Updated: 1/31/2026

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

CVSS v2

Risk Factor: High

Base Score: 7.6

Temporal Score: 6

Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-9086

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.6

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS Score Source: CVE-2025-0725

Vulnerability Information

CPE: p-cpe:/a:huawei:euleros:curl, p-cpe:/a:huawei:euleros:libcurl, cpe:/o:huawei:euleros:uvp:2.10.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/EulerOS/release, Host/EulerOS/rpm-list, Host/EulerOS/uvp_version

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/30/2026

Vulnerability Publication Date: 12/12/2023

Reference Information

CVE: CVE-2025-0725, CVE-2025-10966, CVE-2025-9086

IAVA: 2025-A-0085-S, 2025-A-0657-S, 2025-A-0818-S