CVE-2025-25724
list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecif...
Original description
The description as published by the source.
list_item_verbose in tar/util.c in libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Alpine Linux ALPINE-CVE-2025-25724 libarchive Fixed in: 3.7.9-r0
- Debian DEBIAN-CVE-2025-25724 libarchive
References
- advisory github.com
- advisory nvd.nist.gov
- web gist.github.com
- web github.com
- web github.com