CVE-2025-60753: 
Linux Debian Análise e mitigação de vulnerabilidades

An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. The vulnerability (CVE-2025-60753) was disclosed on November 5, 2025, and affects the pattern substitution functionality in bsdtar (NVD).

The vulnerability exists in the pattern substitution code of bsdtar's apply_substitution function within tar/subst.c. When processing certain crafted -s substitution rules with zero-length pattern matches (such as '//', '/^/', or '/a*/'), the code enters an infinite loop that leads to unbounded memory allocation. The vulnerability has received a CVSS 3.1 Base Score of 5.5 (MEDIUM) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (NVD, GitHub Issue).

When exploited, this vulnerability can cause a denial of service condition through an Out-of-Memory crash. The issue occurs due to unbounded memory allocation during pattern substitution processing, which can exhaust system resources (NVD).

Users should upgrade to libarchive bsdtar version 3.8.1 or later which contains the fix for this vulnerability (NVD).