{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/oraclelinux6els/vex/2025/cve-2025-5916-els_os-oraclelinux6els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-10-25T05:00:28Z",
      "generator": {
        "date": "2026-10-25T05:00:28Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2025-5916-ELS_OS-ORACLELINUX6ELS",
      "initial_release_date": "2025-06-09T20:15:00Z",
      "revision_history": [
        {
          "date": "2025-06-09T20:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-10-25T05:00:28Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2025-5916"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Oracle Linux 6",
                "product": {
                  "name": "Oracle Linux 6",
                  "product_id": "Oracle-Linux-6",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Oracle Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.i686",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.i686",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive@2.8.3-7.el6_8?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.i686",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.i686",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive-devel@2.8.3-7.el6_8?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.x86_64",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.x86_64",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive@2.8.3-7.el6_8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/oracle/libarchive-devel@2.8.3-7.el6_8?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive@2.8.3-7.el6_8.tuxcare.els1?arch=i686"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive-devel@2.8.3-7.el6_8.tuxcare.els1?arch=i686"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "i686"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_id": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive@2.8.3-7.el6_8.tuxcare.els1?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                "product": {
                  "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_id": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/cloudlinux/libarchive-devel@2.8.3-7.el6_8.tuxcare.els1?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-0:2.8.3-7.el6_8.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64"
        },
        "product_reference": "libarchive-0:2.8.3-7.el6_8.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.i686 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.i686",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-devel-0:2.8.3-7.el6_8.x86_64 as a component of Oracle Linux 6",
          "product_id": "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
        },
        "product_reference": "libarchive-devel-0:2.8.3-7.el6_8.x86_64",
        "relates_to_product_reference": "Oracle-Linux-6"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-5916",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686",
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
          "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
          "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2025-5916"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2025-5916",
          "url": "https://access.redhat.com/security/cve/CVE-2025-5916"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2370872",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370872"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2568",
          "url": "https://github.com/libarchive/libarchive/pull/2568"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0",
          "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
        }
      ],
      "release_date": "2025-06-09T20:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-10-15T10:08:46.811047Z",
          "details": "This flaw is confined to libarchive’s WARC reader and is only reachable when an application explicitly opens a malicious WARC file claiming an extremely large (>INT64_MAX−4) content length; common tar/zip/cpio extraction paths are unaffected. The attack is local and requires user interaction to process the attacker‑supplied file, with no integrity impact and primarily a denial‑of‑service risk to the calling process. Given the narrow, format‑specific code path and lack of remote or privilege‑escalation implications, this CVE can be safely deprioritized in typical server and VM deployments.",
          "product_ids": [
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-0:2.8.3-7.el6_8.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.i686",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.tuxcare.els1.x86_64",
            "Oracle-Linux-6:libarchive-devel-0:2.8.3-7.el6_8.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}