{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/ubuntu18.04els/vex/2025/cve-2025-1632-els_os-ubuntu18_04els.json" } ], "tracking": { "current_release_date": "2026-08-28T12:56:24Z", "generator": { "date": "2026-08-28T12:56:24Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2025-1632-ELS_OS-UBUNTU18.04ELS", "initial_release_date": "2025-02-24T14:15:00Z", "revision_history": [ { "date": "2025-02-24T14:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-08-28T12:56:24Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2025-1632" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Ubuntu 18.04", "product": { "name": "Ubuntu 18.04", "product_id": "Ubuntu-18", "product_identification_helper": { "cpe": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*" } } } ], "category": "product_family", "name": "Ubuntu" }, { "branches": [ { "category": "product_version", "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "product": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "product_id": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/libarchive-tools@3.2.2-3.1ubuntu0.7?arch=amd64" } } }, { "category": "product_version", "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "product": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "product_id": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/libarchive13@3.2.2-3.1ubuntu0.7?arch=amd64" } } }, { "category": "product_version", "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "product": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "product_id": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/libarchive-dev@3.2.2-3.1ubuntu0.7?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "product": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "product_id": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "product_identification_helper": { "purl": "pkg:deb/ubuntu/bsdcpio@3.2.2-3.1ubuntu0.7?arch=all" } } }, { "category": "product_version", "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "product": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "product_id": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "product_identification_helper": { "purl": "pkg:deb/ubuntu/bsdtar@3.2.2-3.1ubuntu0.7?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "Canonical Ltd." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_id": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libarchive-tools@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_id": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libarchive13@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_id": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libarchive-dev@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_id": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/bsdcpio@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_id": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/bsdtar@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64" }, "product_reference": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64" }, "product_reference": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64" }, "product_reference": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" }, "product_reference": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all" }, "product_reference": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all" }, "product_reference": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64" }, "product_reference": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64" }, "product_reference": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all" }, "product_reference": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all" }, "product_reference": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "relates_to_product_reference": "Ubuntu-18" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-1632", "cwe": { "id": "CWE-404", "name": "Improper Resource Shutdown or Release" }, "notes": [ { "category": "description", "text": "A vulnerability was found in libarchive up to 3.7.7. It has been classified as problematic. This affects the function list of the file bsdunzip.c. The manipulation leads to null pointer dereference. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-1632" }, { "category": "external", "summary": "https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc", "url": "https://github.com/Ekkosun/pocs/blob/main/bsdunzip-poc" }, { "category": "external", "summary": "https://vuldb.com/?ctiid.296619", "url": "https://vuldb.com/?ctiid.296619" }, { "category": "external", "summary": "https://vuldb.com/?id.296619", "url": "https://vuldb.com/?id.296619" }, { "category": "external", "summary": "https://vuldb.com/?submit.496460", "url": "https://vuldb.com/?submit.496460" } ], "release_date": "2025-02-24T14:15:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-08-18T14:36:32.890928Z", "details": "CVE-2025-1632 is a NULL‑pointer dereference in libarchive’s bsdunzip list code that only crashes the bsdunzip userland process, with no confidentiality or integrity impact. Exploitation requires local execution and the ability to run bsdunzip on a crafted ZIP archive; there is no remote vector and no privilege escalation. In managed server/VM environments where bsdunzip is not a network‑exposed component and is only executed when explicitly invoked, this is at worst a localized DoS against a command‑line utility and can be safely deprioritized.", "product_ids": [ "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }