{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2025/cve-2025-5915-els_os-oraclelinux6els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-25T05:00:28Z",
      "generator": {
        "date": "2026-10-25T05:00:28Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2025-5915-ELS_OS-ORACLELINUX6ELS",
      "initial_release_date": "2025-06-09T20:15:00Z",
      "revision_history": [
        {
          "date": "2025-06-09T20:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-25T05:00:28Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2025-5915"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux 6",
                "product": {
                  "name": "Oracle Linux 6",
                  "product_id": "Oracle-Linux-6",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Oracle Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.i686",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.i686",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive@2.8.3-7.el6_8?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.i686",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.i686",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive-devel@2.8.3-7.el6_8?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.x86_64",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.x86_64",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive@2.8.3-7.el6_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive-devel@2.8.3-7.el6_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive@2.8.3-7.el6_8.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive-devel@2.8.3-7.el6_8.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive@2.8.3-7.el6_8.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive-devel@2.8.3-7.el6_8.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-5915",
      "cwe": {
        "id": "CWE-122",
        "name": "Heap-based Buffer Overflow"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686",
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2025-5915"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2025-5915",
          "url": "https://access.redhat.com/security/cve/CVE-2025-5915"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2370865",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370865"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2599",
          "url": "https://github.com/libarchive/libarchive/pull/2599"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0",
          "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
        }
      ],
      "release_date": "2025-06-09T20:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T10:08:46.854439Z",
          "details": "Deprioritize: this bug is only reachable when a local, authenticated user (or a process they invoke) explicitly parses a crafted RAR file with a libarchive-based tool, per the AV:L/PR:L/UI:R vector—libarchive is not a network-exposed service. The flaw is an out‑of‑bounds read in the RAR LZSS path, which can crash the parser or potentially disclose adjacent memory, but does not provide code execution or privilege escalation. In centrally managed Linux server/VM environments that do not ingest untrusted RAR archives as part of normal workflows, the practical risk is low.",
          "product_ids": [
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}