Skip to content
OpenAdvisories
Medium · 4.0 CVE-2025-25724 EUVD-2025-5869GHSA-722w-734r-qg74

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service …

Published Mar 2, 2025 · Updated Mar 4, 2025 · Assigned by mitre

Vendor: libarchive Product: libarchive Package: libarchive Package: libarchive Package: libarchive Package: libarchive Package: libarchive-dev Ecosystem: Alpine Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu Ecosystem: Wolfi

Description

list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.

Affected products

VendorProductAffectedFixed
libarchive libarchive ≤ 3.7.7 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 libarchive 3.8.4-1 —
Debian 13 libarchive No fix yet —
Debian 12 libarchive No fix yet —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 25.10 libarchive 3.7.7-0ubuntu2.1 —
Ubuntu 24.04 LTS libarchive 3.7.2-2ubuntu0.4 USN-7454-1
Ubuntu 22.04 LTS libarchive 3.6.0-1ubuntu1.4 USN-7454-1
Ubuntu 20.04 LTS libarchive 3.4.0-2ubuntu1.5 USN-7454-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS libarchive 3.2.2-3.1ubuntu0.7+esm2 —
Ubuntu Pro 16.04 LTS libarchive 3.1.2-11ubuntu0.16.04.8+esm2 —
Ubuntu Pro 14.04 LTS libarchive 3.1.2-7ubuntu2.8+esm4 —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 10 bsdtar +2 3.7.7-3.el10_0 RHSA-2025:9420
RHEL 9 bsdtar +2 3.5.3-5.el9_6 RHSA-2025:9431
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 9.4 E4S bsdtar +2 3.5.3-5.el9_4.1 RHSA-2026:24383

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 bsdtar +2 3.7.7-3.el10_0 ALSA-2025:9420
AlmaLinux 9 bsdtar +2 3.5.3-5.el9_6 ALSA-2025:9431

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 10 libarchive 3.7.7-3.el10_0 RLSA-2025:9420
Rocky Linux 9 libarchive 3.5.3-5.el9_6 RLSA-2025:9431

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP6 libarchive 3.7.2-150600.3.12.1 SUSE-SU-2025:0985-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLE Micro 6.1 libarchive 3.7.4-slfo.1.1_2.1 SUSE-SU-2025:20257-1
SLE Micro 5.5 libarchive 3.5.1-150400.3.18.1 SUSE-SU-2025:0986-1
SLE Micro 5.4 libarchive 3.5.1-150400.3.18.1 SUSE-SU-2025:0986-1
SLE Micro 5.3 libarchive 3.5.1-150400.3.18.1 SUSE-SU-2025:0986-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed libarchive 3.7.7-3.1 openSUSE-SU-2025:14882-1
openSUSE Leap 15.6 libarchive 3.7.2-150600.3.12.1 SUSE-SU-2025:0985-1

Alpine

Security tracker ↗
ReleasePackageFixed inAdvisory
Alpine v3.24 libarchive 3.7.9-r0 —
Alpine v3.23 libarchive 3.7.9-r0 —
Alpine v3.22 libarchive 3.7.9-r0 —
Alpine v3.21 libarchive 3.7.9-r0 —
Alpine v3.20 libarchive 3.7.9-r0 —
Show 2 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Alpine v3.19 libarchive 3.7.9-r0 —
Alpine v3.18 libarchive 3.7.9-r0 —

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 libarchive 3.7.7-2 —
Azure Linux 2 (CBL-Mariner) libarchive 3.6.1-5 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 10 bsdtar +2 3.7.7-3.el10_0 ELSA-2025-9420
Oracle Linux 9 bsdtar +2 3.5.3-5.el9_6 ELSA-2025-9431

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling libarchive-dev 3.7.7-r2 —

Advisories 18

References