PT-2025-24554 · Unknown+6 · Libarchive+6

Carnil · Published 2025-05-11 · Updated 2025-09-29 · CVE-2025-5915

Positive Technologies (AI Summary)

CVSS v3.1

6.6

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive (affected versions not specified)

Description A flaw in the libarchive library can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This can cause the library to attempt to read beyond the allocated memory buffer, resulting in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

AZL-63786

AZL-63857

BDU:2025-11855

CVE-2025-5915

ECHO-EF0F-BB47-0359

MGASA-2025-0200

OESA-2025-1623

OESA-2025-1624

SUSE-SU-2025:02566-1

SUSE-SU-2025:02718-1

SUSE-SU-2025:02718-2

SUSE-SU-2025:20560-1

SUSE-SU-2025:20594-1

SUSE-SU-2025_02566-1

SUSE-SU-2025_02718-2

USN-7601-1

Affected Products

Astra Linux

Debian

Linuxmint

Red Os

Suse

Ubuntu

Libarchive

References · 68

• https://github.com/libarchive/libarchive/pull/2599 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-5918 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5916 · Security Note
• https://bdu.fstec.ru/vul/2025-11855 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-5915 · Security Note
• https://ubuntu.com/security/notices/USN-7601-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-5916 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1623 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-5915 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-5917 · Security Note
• https://ubuntu.com/security/CVE-2025-5917 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-5915 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-5915 · Vendor Advisory