Nessus Vulnerability - Curl 7.10.5 < 8.12.0 Integer Overflow (CVE-2025-0725)

[Scott Cantor]

(This is still Scott, I'm beginning my transition to a self-employed address from my OSU address...)

We publish frequently updated assessments of unpatched issues in our dependencies on the Security Advisories pages for our software, the SP included. We don't enumerate them once they get long enough.

It is very rare that curl.exe is relevant to any of them, it's the libcurl DLL that's relevant. Notably that CVE impacts use with old zlib versions, well behind what we ship.

>  What mitigation errors would you suggest

Building it all yourself I guess, or pay for membership to elevate your voice in how we spend our members' money if it's a serious concern.

> e.g. is it safe to remove this file from the installation or manually replace it with the later version?

You can always remove curl.exe, the SP doesn't use it, but you certainly can't manually replace it, and doing that with the DLL will likely break the SP.

Absent input from paying members that our choice to not spend our time updating the SP to satisfy scanners isn't the right one, that's going to continue to be the policy. My limited time is prioritized in favor of getting SP 4 usable to address the intractable problem of the native dependencies once and for all.

-- Scott