CVE-2025-6297

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-6297
It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.
CVSS

No CVSS.

References
Link Resource
https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=ed6bbd445dd8800308c67236ba35d08004c98e82 Patch
Configurations

Configuration 1 (hide)

cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*
History

06 Aug 2025, 15:51

Type Values Removed Values Added
CPE cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*
First Time Debian
Debian dpkg
References () https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=ed6bbd445dd8800308c67236ba35d08004c98e82 - () https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=ed6bbd445dd8800308c67236ba35d08004c98e82 - Patch

01 Jul 2025, 18:15

Type Values Removed Values Added
Summary It was discovered that dpkg does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data, which may lead to leave temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up with a DoS scenario due to causing disk quota exhaustion or disk full conditions. It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.

01 Jul 2025, 17:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-07-01 17:15

Updated : 2025-08-19 17:50

NVD link : CVE-2025-6297

Mitre link : CVE-2025-6297

JSON object : View

Products Affected

debian

  • dpkg
CWE

No CWE.