JLSEC-2025-243
- Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/blob/main/advisories/published/2025/JLSEC-2025-243.md
- Import Source
- https://github.com/JuliaLang/SecurityAdvisories.jl/tree/generated/osv/2025/JLSEC-2025-243.json
- JSON Data
- https://api.osv.dev/v1/vulns/JLSEC-2025-243
- Upstream
- Published
- 2025-11-25T22:03:17.636Z
- Modified
- 2026-07-23T22:30:22.966856816Z
- Severity
-
- 7.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- `list_item_verbose` in `tar/util.c` in libarchive through 3.7.7 does not check an strftime return...
- Details
-
list_item_verboseintar/util.cin libarchive through 3.7.7 does not check an strftime return value, which can lead to a denial of service or unspecified other impact via a crafted TAR archive that is read with a verbose value of 2. For example, the 100-byte buffer may not be sufficient for a custom locale. - Database specific
{ "sources": [ { "imported": "2026-07-17T20:49:06.515Z", "id": "CVE-2025-25724", "url": "https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2025-25724", "html_url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25724", "modified": "2026-06-17T09:01:02.647Z", "database_specific": { "status": "Analyzed" }, "published": "2025-03-02T02:15:36.603Z" }, { "id": "GHSA-722w-734r-qg74", "url": "https://api.github.com/advisories/GHSA-722w-734r-qg74", "html_url": "https://github.com/advisories/GHSA-722w-734r-qg74", "modified": "2025-03-02T03:30:37Z", "imported": "2026-07-17T20:49:07.331Z", "published": "2025-03-02T03:30:31Z" }, { "id": "EUVD-2025-5869", "url": "https://euvdservices.enisa.europa.eu/api/enisaid?id=EUVD-2025-5869", "html_url": "https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-5869", "modified": "2025-03-04T19:00:41Z", "imported": "2026-07-17T20:49:07.978Z", "published": "2025-03-02T00:00:00Z" } ], "license": "CC-BY-4.0" }- References
-
- https://gist.github.com/Ekkosun/a83870ce7f3b7813b9b462a395e8ad92
- https://github.com/Ekkosun/pocs/blob/main/bsdtarbug
- https://github.com/advisories/GHSA-722w-734r-qg74
- https://github.com/libarchive/libarchive/blob/b439d586f53911c84be5e380445a8a259e19114c/tar/util.c#L751-L752
- https://nvd.nist.gov/vuln/detail/CVE-2025-25724