PT-2025-7714 · Unknown+7 · Libarchive+7

Rookie · Published 2025-02-24 · Updated 2025-05-23 · CVE-2025-1632

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions libarchive versions up to 3.7.7

Description A problematic issue was found in libarchive, affecting the list function of the file bsdunzip.c. This issue leads to a null pointer dereference. The attack can be launched on the local host.

Recommendations For versions up to 3.7.7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

NULL Pointer Dereference

Improper Resource Release

Weakness Enumeration

CWE-476

CWE-404

Related Identifiers

ALT-PU-2025-6653

AZL-57156

BDU:2025-05203

CVE-2025-1632

ECHO-BDDC-4B21-DFD5

OESA-2025-1310

OESA-2025-1311

OPENSUSE-SU-2025:14882-1

OPENSUSE-SU-2025_0985-1

SUSE-SU-2025:0985-1

SUSE-SU-2025:20257-1

SUSE-SU-2025_0985-1

USN-7454-1

Affected Products

Alt Linux

Astra Linux

Debian

Linuxmint

Red Os

Suse

Ubuntu

Libarchive

References · 59

• 🔥 https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc · Exploit
• 🔥 https://vuldb.com/?submit.496460 · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2025:0985-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7454-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-25724 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2025-1632 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1311 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-1632 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14882-1 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1310 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0319SE17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1632 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2025-1632 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:20257-1 · Vendor Advisory