Read the docs
TI-2025-05698 Aliases CVE-2025-6297GHSA-w56q-6jw5-h5xf

dpkg-deb: Fix cleanup for control member with restricted directories

Priority MEDIUM 42CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-400.

Summary

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00478 41st percentileScored 2026-11-07
Fix Fixed dpkg (Debian): ed6bbd445dd8800308c67236ba35d08004c98e82

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Debiandpkgbefore ed6bbd445dd8800308c67236ba35d08004c98e82ed6bbd445dd8800308c67236ba35d08004c98e82Patch availableCNA
  • dpkg VendorDebian Affected before ed6bbd445dd8800308c67236ba35d08004c98e82 Fixed in ed6bbd445dd8800308c67236ba35d08004c98e82 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:*before 1.22.21VulnerableDebian
  • cpe:2.3:a:debian:dpkg:*:*:*:*:*:*:*:* Versions before 1.22.21 Vulnerable ·Debian

Remediation

  • Fix · CNA dpkg (Debian) Fixed in ed6bbd445dd8800308c67236ba35d08004c98e82

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-6297
  2. 2026-10-03 Alias added: GHSA-w56q-6jw5-h5xf

References

Patch 1

  • TI-2017-05855 dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does… CVSS 3.0CRITICAL 9.8
  • TI-2022-01534 directory traversal for in-place extracts with untrusted v2 and v3 source packages with debian.tar CVSS 3.1CRITICAL 9.8
  • TI-2015-00801 Off-by-one error in the extracthalf function in dpkg-deb/extract.c in the dpkg-deb… CVSS 2.0HIGH 7.5
  • TI-2026-01867 Infinite loop in Debian dpkg CVSS 3.1HIGH 7.5
  • TI-2014-07084 Multiple format string vulnerabilities in the parse_error_msg function in parsehelp.c in… CVSS 2.0MEDIUM 6.8
  • TI-2010-01621 Directory traversal vulnerability in dpkg-source in dpkg before 1.14.31 and 1.15.x allows… CVSS 2.0MEDIUM 6.8
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences