DEBIAN-CVE-2025-5916

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive.

References

https://security-tracker.debian.org/tracker/CVE-2025-5916

Affected packages

Debian:11 / libarchive

Package

Name: libarchive
Purl: pkg:deb/debian/libarchive?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.4.3-2+deb11u3

Affected versions

3.*

3.4.3-2

3.4.3-2+deb11u1

3.4.3-2+deb11u2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / libarchive

Package

Name: libarchive
Purl: pkg:deb/debian/libarchive?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.6.2-1+deb12u3

Affected versions

3.*

3.6.2-1

3.6.2-1+deb12u1

3.6.2-1+deb12u2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / libarchive

Package

Name: libarchive
Purl: pkg:deb/debian/libarchive?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.7.4-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:14 / libarchive

Package

Name: libarchive
Purl: pkg:deb/debian/libarchive?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

3.7.4-4

Ecosystem specific

{
    "urgency": "not yet assigned"
}