An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and lead to denial of service (Out-of-Memory crash).

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file     tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and     lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libarchive security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the versions of the libarchive package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file     tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and     lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

    A vulnerability has been identified in the libarchive library. This flaw involves an 'off-by-one'     miscalculation when handling prefixes and suffixes for file names. This can lead to a 1-byte write     overflow. While seemingly small, such an overflow can corrupt adjacent memory, leading to unpredictable     program behavior, crashes, or in specific circumstances, could be leveraged as a building block for more     sophisticated exploitation.(CVE-2025-5917)

    A vulnerability has been identified in the libarchive library, specifically within the     archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately     lead to a double-free condition. Exploiting a double-free vulnerability can result in memory corruption,     enabling an attacker to execute arbitrary code or cause a denial-of-service condition.(CVE-2025-5914)

    A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that     can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4     content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially     leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within     applications that process such archives using libarchive.(CVE-2025-5916)

    A vulnerability has been identified in the libarchive library. This flaw can be triggered when file     streams are piped into bsdtar, potentially allowing for reading past the end of the file. This out-of-     bounds read can lead to unintended consequences, including unpredictable program behavior, memory     corruption, or a denial-of-service condition.(CVE-2025-5918)

Tenable has extracted the preceding description block directly from the EulerOS Virtualization libarchive security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the libarchive package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

    An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file     tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and     lead to denial of service (Out-of-Memory crash).(CVE-2025-60753)

Tenable has extracted the preceding description block directly from the EulerOS libarchive security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0962 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2025-60753:
    An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file     tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and     lead to denial of service (Out-of-Memory crash).

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the libarchive package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An issue was discovered in libarchive bsdtar before version 3.8.1 in function apply_substitution in file     tar/subst.c when processing crafted -s substitution rules. This can cause unbounded memory allocation and     lead to denial of service (Out-of-Memory crash). (CVE-2025-60753)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
302678	EulerOS Virtualization 2.10.0 : libarchive (EulerOS-SA-2026-1558)	Nessus	Huawei Local Security Checks	medium
302675	EulerOS Virtualization 2.12.0 : libarchive (EulerOS-SA-2026-1492)	Nessus	Huawei Local Security Checks	high
302660	EulerOS Virtualization 2.12.1 : libarchive (EulerOS-SA-2026-1435)	Nessus	Huawei Local Security Checks	high
302634	EulerOS Virtualization 2.10.1 : libarchive (EulerOS-SA-2026-1538)	Nessus	Huawei Local Security Checks	medium
302469	EulerOS 2.0 SP10 : libarchive (EulerOS-SA-2026-1340)	Nessus	Huawei Local Security Checks	medium
302435	EulerOS 2.0 SP10 : libarchive (EulerOS-SA-2026-1314)	Nessus	Huawei Local Security Checks	medium
302415	EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2026-1398)	Nessus	Huawei Local Security Checks	medium
302378	EulerOS 2.0 SP12 : libarchive (EulerOS-SA-2026-1367)	Nessus	Huawei Local Security Checks	medium
301629	EulerOS 2.0 SP13 : libarchive (EulerOS-SA-2026-1281)	Nessus	Huawei Local Security Checks	medium
301576	EulerOS 2.0 SP13 : libarchive (EulerOS-SA-2026-1245)	Nessus	Huawei Local Security Checks	medium
279654	TencentOS Server 4: libarchive (TSSA-2025:0962)	Nessus	Tencent Local Security Checks	medium
275317	Photon OS 5.0: Libarchive PHSA-2025-5.0-0672	Nessus	PhotonOS Local Security Checks	medium
274085	Linux Distros Unpatched Vulnerability : CVE-2025-60753	Nessus	Misc.	medium

Detections

Analytics

CVE-2025-60753

medium

Tenable Plugins

medium

high

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium