Resource exhaustion in libarchive - CVE-2025-60753

Vulnerability identifier: #VU118347

CSH Severity: Medium

CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-60753

CWE-ID: CWE-400

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources within bsdtar in the "apply_substitution" function in the "tar/subst.c" file. A remote attacker can trigger resource exhaustion and perform a denial of service (DoS) attack.

libarchive
Ubuntu
openEuler
Anolis OS
libarchive (Ubuntu package)
libarchive-debuginfo
libarchive
libarchive-debugsource
libarchive-devel
libarchive-help
bsdtar
bsdcat
bsdcpio
bsdunzip
libarchive-doc

Install update from vendor's website.

libarchive - update to 3.8.3
libarchive (Ubuntu package) - addressed in versions 3.1.2-7ubuntu2.8+esm4, 3.1.2-11ubuntu0.16.04.8+esm2, 3.2.2-3.1ubuntu0.7+esm2, 3.4.0-2ubuntu1.5+esm1, 3.6.0-1ubuntu1.6, 3.7.2-2ubuntu0.6, 3.7.7-0ubuntu3.1
libarchive-debuginfo - addressed in versions 3.4.3-11, 3.5.2-10, 3.7.1-8
libarchive - addressed in versions 3.4.3-11, 3.5.2-10, 3.7.1-8
libarchive-debugsource - addressed in versions 3.4.3-11, 3.5.2-10, 3.7.1-8
libarchive-devel - addressed in versions 3.4.3-11, 3.5.2-10, 3.7.1-8
libarchive-help - addressed in versions 3.4.3-11, 3.5.2-10, 3.7.1-8
bsdtar - addressed in versions 3.5.2-10, 3.7.1-8
bsdcat - addressed in versions 3.5.2-10, 3.7.1-8
bsdcpio - addressed in versions 3.5.2-10, 3.7.1-8
bsdunzip - update to 3.7.1-8
bsdunzip - update to 3.7.1-9
libarchive - update to 3.7.1-9
libarchive-devel - update to 3.7.1-9
libarchive-doc - update to 3.7.1-9
bsdtar - update to 3.7.1-9
bsdcpio - update to 3.7.1-9
bsdcat - update to 3.7.1-9

• https://github.com/Papya-j/CVE/tree/main/CVE-2025-60753
• https://github.com/libarchive/libarchive/issues/2725
• https://github.com/advisories/GHSA-qm3h-46xc-w7w4

• Denial of service in libarchive
• openEuler 24.03 LTS SP1 update for libarchive
• openEuler 24.03 LTS update for libarchive
• Anolis OS update for libarchive
• openEuler 24.03 LTS SP2 update for libarchive
• openEuler 22.03 LTS SP4 update for libarchive
• openEuler 22.03 LTS SP3 update for libarchive
• openEuler 20.03 LTS SP4 update for libarchive
• Ubuntu update for libarchive