Incorrect default permissions in dpkg - CVE-2025-6297

Vulnerability identifier: #VU113836

CSH Severity: Low

CVSS v4: 5.9 [CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-6297

CWE-ID: CWE-276

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the way the package manager handles temporary files during extraction into a temp directory. A remote attacker can trick the victim into installing a specially crafted package and consume all available disk space, leading to a denial of service condition.  

dpkg
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Fedora
Development Tools Module
Basesystem Module
openSUSE Leap
Ubuntu
Anolis OS
update-alternatives
dpkg-debugsource
update-alternatives-debuginfo
update-alternatives-debugsource
dpkg-lang
dpkg-devel
dpkg
dpkg-debuginfo
dpkg (Ubuntu package)
dselect
dpkg-perl
dpkg-dev
dpkg-doc

Install updates from vendor's website.

dpkg - update to 1.22.21
update-alternatives - update to 1.19.0.4-150000.4.7.1
dpkg-debugsource - update to 1.19.0.4-150000.4.7.1
update-alternatives-debuginfo - update to 1.19.0.4-150000.4.7.1
update-alternatives-debugsource - update to 1.19.0.4-150000.4.7.1
dpkg-lang - update to 1.19.0.4-150000.4.7.1
dpkg-devel - update to 1.19.0.4-150000.4.7.1
dpkg - update to 1.19.0.4-150000.4.7.1
dpkg-debuginfo - update to 1.19.0.4-150000.4.7.1
dpkg (Ubuntu package) - addressed in versions 1.21.1ubuntu2.6, 1.22.6ubuntu6.5, 1.22.18ubuntu2.2
dselect - update to 1.22.2-3
dpkg - update to 1.22.2-3
dpkg-devel - update to 1.22.2-3
dpkg-perl - update to 1.22.2-3
dpkg-dev - update to 1.22.2-3
dpkg-doc - update to 1.22.2-3
dpkg - addressed in versions 1.22.20-1.el9, 1.22.20-1.el10_0, 1.22.20-1.el10_1, 1.22.20-1.fc41, 1.22.20-1.fc42

• https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=ed6bbd445dd8800308c67236ba35d08004c98e82

• Denial of service in dpkg
• Fedora EPEL 9 update for dpkg
• Fedora EPEL 10.1 update for dpkg
• Fedora EPEL 10.0 update for dpkg
• Fedora 41 update for dpkg
• Fedora 42 update for dpkg
• SUSE update for dpkg
• SUSE update for dpkg
• Anolis OS update for dpkg
• Ubuntu update for dpkg