Homepage

CVE-2025-25724 Affecting libarchive package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-LIBARCHIVE-9056155
  • published4 Mar 2025
  • disclosed2 Mar 2025
Report a new vulnerability Found a mistake?

Introduced: 2 Mar 2025

NewCVE-2025-25724  (opens in a new tab)

How to fix?

There is no fixed version for Debian:12 libarchive.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libarchive package and not the libarchive package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.