rpm package
opensuse/xz&distro=openSUSE Tumbleweed
pkg:rpm/opensuse/xz&distro=openSUSE%20Tumbleweed
Vulnerabilities (4)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-34743 | Med | 5.3 | < 5.8.3-1.1 | 5.8.3-1.1 | Apr 2, 2026 | XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() wo | |
| CVE-2025-31115 | Hig | — | < 5.8.1-1.1 | 5.8.1-1.1 | Apr 3, 2025 | XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an a | |
| CVE-2024-3094 | — | < 5.6.2-1.1 | 5.6.2-1.1 | Mar 29, 2024 | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify sp | ||
| CVE-2022-1271 | — | < 5.2.6-1.1 | 5.2.6-1.1 | Aug 31, 2022 | An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insuf |
- affected < 5.8.3-1.1fixed 5.8.3-1.1
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() wo
- affected < 5.8.1-1.1fixed 5.8.1-1.1
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an a
- CVE-2024-3094Mar 29, 2024affected < 5.6.2-1.1fixed 5.6.2-1.1
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify sp
- CVE-2022-1271Aug 31, 2022affected < 5.2.6-1.1fixed 5.2.6-1.1
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insuf