EUVD-2025-17573
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:L
Lifecycle Timeline
4Description
A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.
Analysis
A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.
Technical Context
An out-of-bounds memory access occurs when code reads from or writes to memory locations outside the intended buffer boundaries. This vulnerability is classified as Out-of-bounds Read (CWE-125).
Affected Products
Affected products: Libarchive Libarchive, Redhat Openshift Container Platform 4.0, Redhat Enterprise Linux 6.0
Remediation
A vendor patch is available — apply it immediately. Implement proper bounds checking on all array and buffer accesses. Use memory-safe languages or static analysis tools to detect OOB issues.
Priority Score
Vendor Status
Ubuntu
Priority: Low| Release | Status | Version |
|---|---|---|
| trusty | needs-triage | - |
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | needs-triage | - |
| upstream | released | 3.8.0 |
| oracular | ignored | end of life, was needs-triage |
| plucky | ignored | end of life, was needs-triage |
| questing | needs-triage | - |
Debian
Bug #1107624| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 3.4.3-2+deb11u3 | - |
| bullseye (security) | fixed | 3.4.3-2+deb11u3 | - |
| bookworm | vulnerable | 3.6.2-1+deb12u3 | - |
| bookworm (security) | vulnerable | 3.6.2-1+deb12u2 | - |
| trixie | vulnerable | 3.7.4-4 | - |
| forky, sid | fixed | 3.8.5-1 | - |
| (unstable) | fixed | 3.8.4-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today