CVE-2025-6297 - CVE House
Back to Database
Status published Unknown CVE-2025-6297

dpkg-deb: Fix cleanup for control member with restricted directories

Vulnerability Description

It was discovered that dpkg-deb does not properly sanitize directory permissions when extracting a control member into a temporary directory, which is documented as being a safe operation even on untrusted data. This may result in leaving temporary files behind on cleanup. Given automated and repeated execution of dpkg-deb commands on adversarial .deb packages or with well compressible files, placed inside a directory with permissions not allowing removal by a non-root user, this can end up in a DoS scenario due to causing disk quota exhaustion or disk full conditions.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6297

Credits & Attribution

No credits recorded in the NVD database.

References

More from Debian

View All →
CVE-2025-8454
It was discovered that uscan, a tool to scan/watch upstream...
Unknown 0
CVE-2025-68462
Freedombox before 25.17.1 does not set proper permissions for the...
Low 3.2
CVE-2025-53391
The Debian zuluPolkit/CMakeLists.txt file for zuluCrypt through the zulucrypt_6.2.0-1 package...
Critical 9.3
CVE-2025-47153
Certain build processes for libuv and Node.js for 32-bit systems,...
Medium 6.5
CVE-2024-2312
GRUB2 does not call the module fini functions on exit,...
Medium 6.7

Affected Vendor

Affected Software

dpkg
Vulnerable Versions:
0

Timeline

Official Publish: July 1st, 2025
Last Modified: July 8th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.