PT-2025-45112 · Bsdcpio+6 · Bsdcpio+6

Published 2025-08-20 · Updated 2026-04-20 · CVE-2025-60753

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive versions prior to 3.8.1

Description The software is a BSD-licensed C programming library providing streaming access to various archive formats like tar, cpio, pax, zip, and ISO9660 images. It includes bsdtar and bsdcpio implementations. A flaw exists in the apply substitution function within tar/subst.c when handling specially crafted -s substitution rules. This can result in excessive memory allocation, potentially leading to a denial of service through an out-of-memory crash.

Recommendations Update to version 3.8.1 or later.

Exploit

Fix

DoS

Infinite Loop

Resource Exhaustion

Weakness Enumeration

CWE-835

CWE-400

Related Identifiers

AZL-69866

AZL-69893

BDU:2026-00318

CVE-2025-60753

ECHO-332C-D1F1-FB8F

JLSEC-2026-153

OESA-2025-2761

OESA-2025-2762

RHSA-2026:8944

USN-8147-1

Affected Products

Debian

Linuxmint

Red Os

Ubuntu

Bsdcpio

Bsdtar

Libarchive

References · 37

• 🔥 https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753 · Exploit
• https://github.com/libarchive/libarchive/issues/2725 · Patch
• https://security-tracker.debian.org/tracker/CVE-2025-60753 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-5917 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-60753 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-60753 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-8147-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2761 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-60753 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-5916 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2762 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0305SE38 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-25724 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-19221 · Vendor Advisory