{ "document": { "aggregate_severity": { "text": "Medium" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/ubuntu18.04els/vex/2025/cve-2025-5917-els_os-ubuntu18_04els.json" } ], "tracking": { "current_release_date": "2026-08-28T12:56:24Z", "generator": { "date": "2026-08-28T12:56:24Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2025-5917-ELS_OS-UBUNTU18.04ELS", "initial_release_date": "2025-06-09T20:15:00Z", "revision_history": [ { "date": "2025-06-09T20:15:00Z", "number": "1", "summary": "Initial version" }, { "date": "2026-08-28T12:56:24Z", "number": "2", "summary": "Official Publication" } ], "status": "final", "version": "2" }, "title": "Security update on CVE-2025-5917" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Ubuntu 18.04", "product": { "name": "Ubuntu 18.04", "product_id": "Ubuntu-18", "product_identification_helper": { "cpe": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*" } } } ], "category": "product_family", "name": "Ubuntu" }, { "branches": [ { "category": "product_version", "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "product": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "product_id": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/libarchive-tools@3.2.2-3.1ubuntu0.7?arch=amd64" } } }, { "category": "product_version", "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "product": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "product_id": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/libarchive13@3.2.2-3.1ubuntu0.7?arch=amd64" } } }, { "category": "product_version", "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "product": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "product_id": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "product_identification_helper": { "purl": "pkg:deb/ubuntu/libarchive-dev@3.2.2-3.1ubuntu0.7?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "product": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "product_id": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "product_identification_helper": { "purl": "pkg:deb/ubuntu/bsdcpio@3.2.2-3.1ubuntu0.7?arch=all" } } }, { "category": "product_version", "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "product": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "product_id": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "product_identification_helper": { "purl": "pkg:deb/ubuntu/bsdtar@3.2.2-3.1ubuntu0.7?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "Canonical Ltd." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_id": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libarchive-tools@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_id": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libarchive13@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64" } } }, { "category": "product_version", "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_id": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/libarchive-dev@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64" } } } ], "category": "architecture", "name": "amd64" }, { "branches": [ { "category": "product_version", "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_id": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/bsdcpio@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=all" } } }, { "category": "product_version", "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_id": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "product_identification_helper": { "purl": "pkg:deb/cloudlinux/bsdtar@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=all" } } } ], "category": "architecture", "name": "all" } ], "category": "vendor", "name": "CloudLinux" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64" }, "product_reference": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64" }, "product_reference": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64" }, "product_reference": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" }, "product_reference": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all" }, "product_reference": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all" }, "product_reference": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64" }, "product_reference": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64" }, "product_reference": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all" }, "product_reference": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "relates_to_product_reference": "Ubuntu-18" }, { "category": "default_component_of", "full_product_name": { "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all as a component of Ubuntu 18.04", "product_id": "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all" }, "product_reference": "bsdtar-0:3.2.2-3.1ubuntu0.7.all", "relates_to_product_reference": "Ubuntu-18" } ] }, "vulnerabilities": [ { "cve": "CVE-2025-5917", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one' miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more sophisticated exploitation. This bug affects libarchive versions prior to 3.8.0.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "known_affected": [ "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-5917" }, { "category": "external", "summary": "https://access.redhat.com/security/cve/CVE-2025-5917", "url": "https://access.redhat.com/security/cve/CVE-2025-5917" }, { "category": "external", "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2370874", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370874" }, { "category": "external", "summary": "https://github.com/libarchive/libarchive/pull/2588", "url": "https://github.com/libarchive/libarchive/pull/2588" }, { "category": "external", "summary": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0", "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0" } ], "release_date": "2025-06-09T20:15:00Z", "remediations": [ { "category": "no_fix_planned", "date": "2026-08-22T12:11:54.646100Z", "details": "CVE-2025-5917 is confined to libarchive’s tar/pax archive creation path (build_ustar_entry_name in archive_write_set_format_pax.c) and only triggers when an application writes an archive with attacker-controlled, pathologically long file names, making it unreachable via archive extraction or over the network. Its CVSS profile reflects a local, user‑interaction‑dependent condition with availability-only impact; the flaw is a constrained 1‑byte write that is far more likely to cause a process crash than to enable code execution. Given these conditions and that server workloads rarely generate archives from untrusted paths, this presents minimal practical risk in managed enterprise environments and can be safely deprioritized.", "product_ids": [ "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all", "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64", "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }