{
  "document": {
    "aggregate_severity": {
      "text": "Medium"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "TuxCare License Agreement",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://tuxcare.com/contact/",
      "name": "TuxCare",
      "namespace": "https://tuxcare.com/"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.tuxcare.com/csaf/v2/els_os/ubuntu18.04els/vex/2025/cve-2025-5918-els_os-ubuntu18_04els.json"
      }
    ],
    "tracking": {
      "current_release_date": "2026-08-28T12:56:24Z",
      "generator": {
        "date": "2026-08-28T12:56:24Z",
        "engine": {
          "name": "pyCSAF"
        }
      },
      "id": "CVE-2025-5918-ELS_OS-UBUNTU18.04ELS",
      "initial_release_date": "2025-06-09T20:15:00Z",
      "revision_history": [
        {
          "date": "2025-06-09T20:15:00Z",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-28T12:56:24Z",
          "number": "2",
          "summary": "Official Publication"
        }
      ],
      "status": "final",
      "version": "2"
    },
    "title": "Security update on CVE-2025-5918"
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Ubuntu 18.04",
                "product": {
                  "name": "Ubuntu 18.04",
                  "product_id": "Ubuntu-18",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Ubuntu"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
                "product": {
                  "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_id": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/ubuntu/libarchive-tools@3.2.2-3.1ubuntu0.7?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64",
                "product": {
                  "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_id": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/ubuntu/libarchive13@3.2.2-3.1ubuntu0.7?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
                "product": {
                  "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_id": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/ubuntu/libarchive-dev@3.2.2-3.1ubuntu0.7?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
                "product": {
                  "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
                  "product_id": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/ubuntu/bsdcpio@3.2.2-3.1ubuntu0.7?arch=all"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all",
                "product": {
                  "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all",
                  "product_id": "bsdtar-0:3.2.2-3.1ubuntu0.7.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/ubuntu/bsdtar@3.2.2-3.1ubuntu0.7?arch=all"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "all"
          }
        ],
        "category": "vendor",
        "name": "Canonical Ltd."
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                "product": {
                  "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_id": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/libarchive-tools@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                "product": {
                  "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_id": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/libarchive13@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                "product": {
                  "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_id": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/libarchive-dev@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=amd64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                "product": {
                  "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                  "product_id": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/bsdcpio@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=all"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                "product": {
                  "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                  "product_id": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
                  "product_identification_helper": {
                    "purl": "pkg:deb/cloudlinux/bsdtar@3.2.2-3.1ubuntu0.7%2Btuxcare.els1?arch=all"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "all"
          }
        ],
        "category": "vendor",
        "name": "CloudLinux"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64"
        },
        "product_reference": "libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64"
        },
        "product_reference": "libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64"
        },
        "product_reference": "libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64"
        },
        "product_reference": "libarchive13-0:3.2.2-3.1ubuntu0.7.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all"
        },
        "product_reference": "bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all"
        },
        "product_reference": "bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64"
        },
        "product_reference": "libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64 as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64"
        },
        "product_reference": "libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all"
        },
        "product_reference": "bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
        "relates_to_product_reference": "Ubuntu-18"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "bsdtar-0:3.2.2-3.1ubuntu0.7.all as a component of Ubuntu 18.04",
          "product_id": "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all"
        },
        "product_reference": "bsdtar-0:3.2.2-3.1ubuntu0.7.all",
        "relates_to_product_reference": "Ubuntu-18"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-5918",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability has been identified in the libarchive library. This flaw can be triggered when file streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-bounds read can lead to unintended consequences, including unpredictable program behavior, memory corruption, or a denial-of-service condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_affected": [
          "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
          "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
          "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
          "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all",
          "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
          "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
          "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
          "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
          "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
          "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://cve.tuxcare.com/els/cve/CVE-2025-5918"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/security/cve/CVE-2025-5918",
          "url": "https://access.redhat.com/security/cve/CVE-2025-5918"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2370877",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2370877"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/pull/2584",
          "url": "https://github.com/libarchive/libarchive/pull/2584"
        },
        {
          "category": "external",
          "summary": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0",
          "url": "https://github.com/libarchive/libarchive/releases/tag/v3.8.0"
        }
      ],
      "release_date": "2025-06-09T20:15:00Z",
      "remediations": [
        {
          "category": "no_fix_planned",
          "date": "2026-08-22T12:11:53.818238Z",
          "details": "This flaw is local-only and requires a user to actively invoke bsdtar and feed it a crafted stream via a pipe; it results in an out‑of‑bounds read with no reliable path to code execution, typically limited to a crash or possible disclosure from the bsdtar process memory. Exploitation provides no privilege escalation and the scope is unchanged, so impact is confined to the invoking user’s session. In centrally managed VM/server environments where untrusted interactive shell use is limited and archive handling commonly uses on-disk files rather than piped stdin, this is a low‑priority issue compared to remotely exploitable or privilege‑escalation vulnerabilities.",
          "product_ids": [
            "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
            "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
            "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
            "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all",
            "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
            "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
            "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
            "Ubuntu-18:bsdcpio-0:3.2.2-3.1ubuntu0.7.all",
            "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.all",
            "Ubuntu-18:bsdtar-0:3.2.2-3.1ubuntu0.7.all",
            "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive-dev-0:3.2.2-3.1ubuntu0.7.amd64",
            "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive-tools-0:3.2.2-3.1ubuntu0.7.amd64",
            "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7+tuxcare.els1.amd64",
            "Ubuntu-18:libarchive13-0:3.2.2-3.1ubuntu0.7.amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ]
    }
  ]
}