{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/ubuntu18.04els/vex/2025/cve-2025-5915-els_os-ubuntu18_04els.json" } ], "tracking": { "current_release_date": "2026-08-28T12:56:24Z", "generator": { "date": "2026-08-28T12:56:24Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2025-5915-ELS_OS-UBUNTU18.04ELS", "initial_release_date": "2025-06-09T20:15:00Z", "revision_history": [ { "date": "2025-06-09T20:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-08-28T12:56:24Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2025-5915" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Ubuntu 18.04", "product": { "name": "Ubuntu 18.04", "product_id": "Ubuntu-18", "product_identification_helper": { "cpe": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*" } } } ], "category": "product_family", "name": "Ubuntu" }, { "branches": [ { "category": "product_version", "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "product": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "product_id": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/libarchive-tools@3.2.2-3.1ubuntu0.7?arch=amd64" } } }, { "category": "product_version", "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "product": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "product_id": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/libarchive13@3.2.2-3.1ubuntu0.7?arch=amd64" } } }, { "category": "product_version", "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "product": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "product_id": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/libarchive-dev@3.2.2-3.1ubuntu0.7?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "product": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "product_id": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "product_identification_helper": { "purl": "pkg:deb/ubuntu/bsdcpio@3.2.2-3.1ubuntu0.7?arch=all" } } }, { "category": "product_version", "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "product": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "product_id": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "product_identification_helper": { "purl": "pkg:deb/ubuntu/bsdtar@3.2.2-3.1ubuntu0.7?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "Canonical Ltd." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_id": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libarchive-tools@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_id": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libarchive13@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_id": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libarchive-dev@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_id": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/bsdcpio@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_id": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/bsdtar@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64" }, "product_reference": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64" }, "product_reference": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64" }, "product_reference": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" }, "product_reference": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all" }, "product_reference": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all" }, "product_reference": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64" }, "product_reference": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64" }, "product_reference": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all" }, "product_reference": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all" }, "product_reference": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "relates_to_product_reference": "Ubuntu-18" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-5915", "cwe": { "id": "CWE-122", "name": "Heap-based Buffer Overflow" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-5915" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2025-5915", "url": "https://access.redhat.com/security/cve/CVE-2025-5915" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2370865", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370865" }, { "category": "external", "summary": "https://github.com/libarchive/libarchive/pull/2599", "url": "https://github.com/libarchive/libarchive/pull/2599" }, { "category": "external", "summary": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0", "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0" } ], "release_date": "2025-06-09T20:15:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-08-22T12:11:54.721913Z", "details": "This issue is only reachable when a program using libarchive actively parses a crafted RAR file via the RAR-specific reader (copy_from_lzss_window in archive_read_support_format_rar.c), and it requires local privileges plus user interaction, not a remote/network trigger. The flaw is an out-of-bounds read (heap buffer over‑read), which can cause a crash or limited memory disclosure but does not provide write primitives or code execution. Systems that handle tar/cpio or other non‑RAR formats in routine server/VM workflows do not traverse this code path, making real-world exploitability in managed enterprise environments low.", "product_ids": [ "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H", "version": "3.1" }, "products": [ "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }