CVE-2025-60753
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution...
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
- Record
CVE-2025-60753- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-835, CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2025-37900
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
- Record
EUVD-2025-37900- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-qm3h-46xc-w7w4
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution...
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
- Record
GHSA-qm3h-46xc-w7w4- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
- Record
CVE-2025-60753- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-835
- Updated
- 2026-11-05
OSVBELL-CVE-2025-60753
- Record
BELL-CVE-2025-60753- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
- Record
CVE-2025-60753- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
Show 21 moreShow less
OSVDEBIAN-CVE-2025-60753
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
- Record
DEBIAN-CVE-2025-60753- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
OSVJLSEC-2026-153
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
- Record
JLSEC-2026-153- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-2761
libarchive security update
is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .
Security Fix(es):
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)
- Record
OESA-2025-2761- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-2762
libarchive security update
is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .
Security Fix(es):
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)
- Record
OESA-2025-2762- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-2784
libarchive security update
is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .
Security Fix(es):
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)
- Record
OESA-2025-2784- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-2785
libarchive security update
is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .
Security Fix(es):
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)
- Record
OESA-2025-2785- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-2786
libarchive security update
is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .
Security Fix(es):
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)
- Record
OESA-2025-2786- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-2787
libarchive security update
is an open-source BSD-licensed C programming library that provides streaming access to a variety of different archive formats, including tar, cpio, pax, zip, and ISO9660 images. The distribution also includes bsdtar and bsdcpio, full-featured implementations of tar and cpio that use .
Security Fix(es):
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)
- Record
OESA-2025-2787- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:8944
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:8944- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2025-60753
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
- Record
UBUNTU-CVE-2025-60753- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-69866 No score
CVE-2025-60753 affecting package libarchive for versions less than 3.7.7-4
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
- Record
AZL-69866- Updated
- 2026-11-05
OSVAZL-69893 No score
CVE-2025-60753 affecting package libarchive for versions less than 3.6.1-8
An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).
- Record
AZL-69893- Updated
- 2026-11-02
OSVCLSA-2026-1778893359 No score
libarchive: Fix of CVE-2025-60753
- CVE-2025-60753: denial of service in bsdtar -s substitution when the regular expression matches a zero-length string, causing an infinite loop in apply_substitution
- Record
CLSA-2026-1778893359- Updated
- 2026-11-02
OSVCLSA-2026-1778894153 No score
libarchive: Fix of CVE-2025-60753
- CVE-2025-60753: denial of service in bsdtar -s substitution when the regular expression matches a zero-length string, causing an infinite loop in apply_substitution
- Record
CLSA-2026-1778894153- Updated
- 2026-11-02
OSVMGASA-2026-0241 No score
Updated libarchive packages fix security vulnerabilities
The updated packages fix bugs including security ones.
- Record
MGASA-2026-0241- Updated
- 2026-11-02
OSVMGASA-2026-0366 No score
Updated libarchive packages fix security vulnerabilities
Double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack(). (CVE-2026-14164) Heap overflow oob read while parsing a tar archive contains a pax extended header. (CVE-2026-15028) A null pointer dereference vulnerability exists in the acl parser of libarchive. (CVE-2026-5745) Reading past eof may be triggered for piped file streams. (CVE-2025-5918) An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash). (CVE-2025-60753) Infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive. (CVE-2026-4111) Information disclosure via heap out-of-bounds read in rar archive processing. (CVE-2026-4424) Denial of service via malformed iso file processing. (CVE-2026-4426) Arbitrary code execution via integer overflow in iso9660 image processing. (CVE-2026-5121)
- Record
MGASA-2026-0366- Updated
- 2026-11-02
OSVSUSE-SU-2026:22241-1 No score
Security update for libarchive
This update for libarchive fixes the following issues
- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).
- Record
SUSE-SU-2026:22241-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:22248-1 No score
Security update for libarchive
This update for libarchive fixes the following issues
- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).
- Record
SUSE-SU-2026:22248-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2490-1 No score
Security update for libarchive
This update for libarchive fixes the following issues
- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).
- Record
SUSE-SU-2026:2490-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2599-1 No score
Security update for libarchive
This update for libarchive fixes the following issues
- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
- CVE-2026-4111: logical deadlock the RAR5 filter subsystem and the half-window output limiter leads to infinite loop and DoS (bsc#1259635).
- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).
- Record
SUSE-SU-2026:2599-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:2747-1 No score
Security update for libarchive
This update for libarchive fixes the following issues
- CVE-2025-60753: bsdtar hangs and OOMs with zero-length pattern matches (bsc#1253088).
- CVE-2026-4424: information disclosure via heap out-of-bounds read in RAR archive processing (bsc#1259928).
- CVE-2026-4426: undefined behavior due to unvalidated operand in shift expression of the zisofs decompression code (bsc#1259931).
- CVE-2026-5121: arbitrary code execution via integer overflow in ISO9660 image processing (bsc#1261186).
- Record
SUSE-SU-2026:2747-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libarchiveAzure Linux:3 |
before 3.7.7-4 | 3.7.7-4 |
libarchiveAzure Linux:2 |
before 3.6.1-8 | 3.6.1-8 |
libarchiveAlpaquita:23 |
3.6.1-r1 and later | None known |
libarchiveAlpaquita:25 |
3.8.0-r0 and later | None known |
libarchiveAlpaquita:stream |
3.6.2-r1 and later | None known |
bsdcatTuxCare:AlmaLinux:9.2 |
before 3.5.3-6.el9_2.tuxcare.els7 | 3.5.3-6.el9_2.tuxcare.els7 |
bsdcpioTuxCare:AlmaLinux:9.2 |
before 3.5.3-6.el9_2.tuxcare.els7 | 3.5.3-6.el9_2.tuxcare.els7 |
bsdtarTuxCare:AlmaLinux:9.2 |
before 3.5.3-6.el9_2.tuxcare.els7 | 3.5.3-6.el9_2.tuxcare.els7 |
libarchiveTuxCare:AlmaLinux:9.2 |
before 3.5.3-6.el9_2.tuxcare.els7 | 3.5.3-6.el9_2.tuxcare.els7 |
libarchive-develTuxCare:AlmaLinux:9.2 |
before 3.5.3-6.el9_2.tuxcare.els7 | 3.5.3-6.el9_2.tuxcare.els7 |
Show 46 moreShow less
| Package | Affected | Fixed |
|---|---|---|
bsdcatTuxCare:AlmaLinux:9.6 |
before 3.5.3-6.el9_6.tuxcare.els7 | 3.5.3-6.el9_6.tuxcare.els7 |
bsdcpioTuxCare:AlmaLinux:9.6 |
before 3.5.3-6.el9_6.tuxcare.els7 | 3.5.3-6.el9_6.tuxcare.els7 |
bsdtarTuxCare:AlmaLinux:9.6 |
before 3.5.3-6.el9_6.tuxcare.els7 | 3.5.3-6.el9_6.tuxcare.els7 |
libarchiveTuxCare:AlmaLinux:9.6 |
before 3.5.3-6.el9_6.tuxcare.els7 | 3.5.3-6.el9_6.tuxcare.els7 |
libarchive-develTuxCare:AlmaLinux:9.6 |
before 3.5.3-6.el9_6.tuxcare.els7 | 3.5.3-6.el9_6.tuxcare.els7 |
libarchiveDebian:12 |
All versions, plus listed versions 3.6.2-13.6.2-1+deb12u13.6.2-1+deb12u23.6.2-1+deb12u33.6.2-1+deb12u4 Show 20 moreShow less3.6.2-1+deb12u53.7.2-13.7.2-1.13.7.2-1.1~exp13.7.2-23.7.2-2.13.7.4-13.7.4-1.13.7.4-23.7.4-33.7.4-43.8.10-13.8.10-23.8.4-13.8.5-13.8.6-13.8.7-13.8.8-13.8.8-23.8.9-1 |
None known |
libarchiveDebian:13 |
All versions, plus listed versions 3.7.4-43.7.4-4+deb13u13.8.10-13.8.10-23.8.4-1 Show 6 moreShow less3.8.5-13.8.6-13.8.7-13.8.8-13.8.8-23.8.9-1 |
None known |
libarchiveDebian:14 |
before 3.8.4-1, plus listed versions 3.7.4-4 |
3.8.4-1 |
LibArchive_jllJulia |
before 3.8.2+0 | 3.8.2+0 |
libarchiveMageia:10 From an advisory covering 6 CVEs |
before 3.8.8-1.mga10 | 3.8.8-1.mga10 |
libarchiveMageia:10 From an advisory covering 9 CVEs |
before 3.8.9-1.mga10 | 3.8.9-1.mga10 |
libarchiveMageia:9 From an advisory covering 9 CVEs |
before 3.6.2-5.6.mga9 | 3.6.2-5.6.mga9 |
libarchiveopenEuler:24.03-LTS |
before 3.7.1-8.oe2403 | 3.7.1-8.oe2403 |
libarchiveopenEuler:24.03-LTS-SP1 |
before 3.7.1-8.oe2403sp1 | 3.7.1-8.oe2403sp1 |
libarchiveopenEuler:20.03-LTS-SP4 |
before 3.4.3-11.oe2003sp4 | 3.4.3-11.oe2003sp4 |
libarchiveopenEuler:22.03-LTS-SP3 |
before 3.5.2-10.oe2203sp3 | 3.5.2-10.oe2203sp3 |
libarchiveopenEuler:22.03-LTS-SP4 |
before 3.5.2-10.oe2203sp4 | 3.5.2-10.oe2203sp4 |
libarchiveopenEuler:24.03-LTS-SP2 |
before 3.7.1-8.oe2403sp2 | 3.7.1-8.oe2403sp2 |
libarchiveRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.8.7-1.hum1 | 0:3.8.7-1.hum1 |
libarchive-develRed Hat:hummingbird:1 From an advisory covering 6 CVEs |
before 0:3.8.7-1.hum1 | 0:3.8.7-1.hum1 |
libarchiveSUSE:Linux Micro 6.0 From an advisory covering 5 CVEs |
before 3.6.2-6.1 | 3.6.2-6.1 |
libarchiveSUSE:Linux Micro 6.1 From an advisory covering 5 CVEs |
before 3.7.4-slfo.1.1_4.1 | 3.7.4-slfo.1.1_4.1 |
libarchiveSUSE:Linux Enterprise Module for Basesystem 15 SP7 From an advisory covering 5 CVEs |
before 3.7.2-150600.3.20.1 | 3.7.2-150600.3.20.1 |
libarchiveSUSE:Linux Enterprise Module for Development Tools 15 SP7 From an advisory covering 5 CVEs |
before 3.7.2-150600.3.20.1 | 3.7.2-150600.3.20.1 |
libarchiveSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 5 CVEs |
before 3.7.2-150600.3.20.1 | 3.7.2-150600.3.20.1 |
libarchiveSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 5 CVEs |
before 3.7.2-150600.3.20.1 | 3.7.2-150600.3.20.1 |
libarchiveSUSE:Linux Enterprise Micro 5.3 From an advisory covering 5 CVEs |
before 3.5.1-150400.3.24.1 | 3.5.1-150400.3.24.1 |
libarchiveSUSE:Linux Enterprise Micro 5.4 From an advisory covering 5 CVEs |
before 3.5.1-150400.3.24.1 | 3.5.1-150400.3.24.1 |
libarchiveSUSE:Linux Enterprise Micro 5.5 From an advisory covering 5 CVEs |
before 3.5.1-150400.3.24.1 | 3.5.1-150400.3.24.1 |
libarchiveSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS From an advisory covering 5 CVEs |
before 3.5.1-150400.3.24.1 | 3.5.1-150400.3.24.1 |
libarchiveSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS From an advisory covering 5 CVEs |
before 3.5.1-150400.3.24.1 | 3.5.1-150400.3.24.1 |
libarchiveSUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS From an advisory covering 5 CVEs |
before 3.5.1-150400.3.24.1 | 3.5.1-150400.3.24.1 |
libarchiveSUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS From an advisory covering 5 CVEs |
before 3.5.1-150400.3.24.1 | 3.5.1-150400.3.24.1 |
libarchiveSUSE:Linux Enterprise Server 15 SP4-LTSS From an advisory covering 5 CVEs |
before 3.5.1-150400.3.24.1 | 3.5.1-150400.3.24.1 |
libarchiveSUSE:Linux Enterprise Server 15 SP5-LTSS From an advisory covering 5 CVEs |
before 3.5.1-150400.3.24.1 | 3.5.1-150400.3.24.1 |
libarchiveSUSE:Linux Enterprise Server for SAP Applications 15 SP4 From an advisory covering 5 CVEs |
before 3.5.1-150400.3.24.1 | 3.5.1-150400.3.24.1 |
libarchiveSUSE:Linux Enterprise Server for SAP Applications 15 SP5 From an advisory covering 5 CVEs |
before 3.5.1-150400.3.24.1 | 3.5.1-150400.3.24.1 |
libarchiveSUSE:Linux Enterprise Server 12 SP5-LTSS From an advisory covering 4 CVEs |
before 3.3.3-32.17.1 | 3.3.3-32.17.1 |
libarchiveSUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 From an advisory covering 4 CVEs |
before 3.3.3-32.17.1 | 3.3.3-32.17.1 |
libarchiveUbuntu:Pro:14.04:LTS |
before 3.1.2-7ubuntu2.8+esm4, plus listed versions 3.1.2-5ubuntu13.1.2-7ubuntu13.1.2-7ubuntu23.1.2-7ubuntu2.13.1.2-7ubuntu2.2 Show 7 moreShow less3.1.2-7ubuntu2.33.1.2-7ubuntu2.43.1.2-7ubuntu2.63.1.2-7ubuntu2.73.1.2-7ubuntu2.83.1.2-7ubuntu2.8+esm13.1.2-7ubuntu2.8+esm3 |
3.1.2-7ubuntu2.8+esm4 |
libarchiveUbuntu:Pro:16.04:LTS |
before 3.1.2-11ubuntu0.16.04.8+esm2, plus listed versions 3.1.2-11build13.1.2-11ubuntu0.16.04.13.1.2-11ubuntu0.16.04.23.1.2-11ubuntu0.16.04.33.1.2-11ubuntu0.16.04.4 Show 5 moreShow less3.1.2-11ubuntu0.16.04.53.1.2-11ubuntu0.16.04.63.1.2-11ubuntu0.16.04.73.1.2-11ubuntu0.16.04.83.1.2-11ubuntu0.16.04.8+esm1 |
3.1.2-11ubuntu0.16.04.8+esm2 |
libarchiveUbuntu:Pro:18.04:LTS |
before 3.2.2-3.1ubuntu0.7+esm2, plus listed versions 3.2.2-3.13.2.2-3.1ubuntu0.13.2.2-3.1ubuntu0.23.2.2-3.1ubuntu0.33.2.2-3.1ubuntu0.4 Show 4 moreShow less3.2.2-3.1ubuntu0.53.2.2-3.1ubuntu0.63.2.2-3.1ubuntu0.73.2.2-3.1ubuntu0.7+esm1 |
3.2.2-3.1ubuntu0.7+esm2 |
libarchiveUbuntu:Pro:20.04:LTS |
before 3.4.0-2ubuntu1.5+esm1, plus listed versions 3.4.0-13.4.0-1build13.4.0-1ubuntu23.4.0-2ubuntu13.4.0-2ubuntu1.1 Show 4 moreShow less3.4.0-2ubuntu1.23.4.0-2ubuntu1.33.4.0-2ubuntu1.43.4.0-2ubuntu1.5 |
3.4.0-2ubuntu1.5+esm1 |
libarchiveUbuntu:22.04:LTS |
before 3.6.0-1ubuntu1.6, plus listed versions 3.4.3-23.4.3-2build13.5.2-13.5.2-1ubuntu13.6.0-1ubuntu1 Show 5 moreShow less3.6.0-1ubuntu1.13.6.0-1ubuntu1.23.6.0-1ubuntu1.33.6.0-1ubuntu1.43.6.0-1ubuntu1.5 |
3.6.0-1ubuntu1.6 |
libarchiveUbuntu:24.04:LTS |
before 3.7.2-2ubuntu0.6, plus listed versions 3.6.2-1ubuntu13.7.2-1ubuntu13.7.2-1ubuntu23.7.2-1.1ubuntu23.7.2-2 Show 5 moreShow less3.7.2-2ubuntu0.13.7.2-2ubuntu0.23.7.2-2ubuntu0.33.7.2-2ubuntu0.43.7.2-2ubuntu0.5 |
3.7.2-2ubuntu0.6 |
libarchiveUbuntu:25.10 |
before 3.7.7-0ubuntu3.1, plus listed versions 3.7.7-0ubuntu23.7.7-0ubuntu2.13.7.7-0ubuntu2.23.7.7-0ubuntu3 |
3.7.7-0ubuntu3.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | NVD | |
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-60753 is a medium vulnerability (CVSS 5.5) in Libarchive, published November 5, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in libarchive 3.7.7-4.
References
github.com/libarchive/libarchive/issues/2725
nvd.nist.gov/vuln/detail/CVE-2025-60753
docs.bell-sw.com/security/cves/CVE-2025-60753
errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778893359.html
Show 64 moreShow less
security-tracker.debian.org/tracker/CVE-2025-60753
advisories.mageia.org/MGASA-2026-0241.html
bugs.mageia.org/show_bug.cgi?id=35836
ubuntu.com/security/notices/USN-8581-1
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-2761
access.redhat.com/errata/RHSA-2026:8944
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_8944.json
bugzilla.redhat.com/show_bug.cgi?id=2412648
cve.org/CVERecord?id=CVE-2025-60753
suse.com/support/update/announcement/2026/suse-su-202622241-1
bugzilla.suse.com/1253088