CVE details
CVE-2025-6297
It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.
Affected ports (1)
| Port | Package | Version | Status | Maintainer |
|---|---|---|---|---|
| archivers/dpkg | dpkg | 1.19.8_1 | unaddressed | ndowens04@gmail.com |
Template for a VuXML entry
Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.
<vuln vid="FIXME (make newentry)">
<topic>FIXME -- FIXME</topic>
<affects>
<package>
<name>dpkg</name>
<range><lt>1.22.21</lt></range>
</package>
</affects>
<description>
<body xmlns="http://www.w3.org/1999/xhtml">
<p>It was discovered that dpkg-deb does not properly sanitize directory
permissions when extracting a control member into a temporary
directory, which is
documented as being a safe operation even on
untrusted data. This may result in leaving temporary files behind on
cleanup. Given automated and repeated execution of dpkg-deb commands
on
adversarial .deb packages or with well compressible files,
placed
inside a directory with permissions not allowing removal by a
non-root
user, this can end up in a DoS scenario due to causing disk
quota
exhaustion or disk full conditions.</p>
</body>
</description>
<references>
<cvename>CVE-2025-6297</cvename>
<url>https://nvd.nist.gov/vuln/detail/CVE-2025-6297</url>
</references>
<dates>
<discovery>2025-07-01</discovery>
<entry>2026-10-25</entry>
</dates>
</vuln>