CVE-2025-60753: Medium severity Libarchive bsdtar vulnerability
An issue was discovered in libarchive bsdtar before version 3.8.1 in function applysubstitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.8.4-1 - Upgrade
Upgrade
debian/libarchiveto a version that resolves this vulnerability.Fixed in 3.8.10-2Fixed in 3.8.11-1 - Upgrade
Upgrade
libarchive/bsdtarto a version that resolves this vulnerability.Fixed in 3.8.1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-60753?
CVE-2025-60753 has a severity rating that can lead to denial of service due to unbounded memory allocation.
How do I fix CVE-2025-60753?
To fix CVE-2025-60753, upgrade libarchive bsdtar to version 3.8.1 or later.
Who is affected by CVE-2025-60753?
CVE-2025-60753 affects versions of libarchive bsdtar prior to 3.8.1.
What type of vulnerability is CVE-2025-60753?
CVE-2025-60753 is a denial of service vulnerability caused by crafted substitution rules.
What do I need to do if I'm using an affected version of libarchive bsdtar?
If using an affected version of libarchive bsdtar, it is crucial to upgrade to the latest version to mitigate the vulnerability.