p PatchFirst

USN-8945-1

USN-8945-1 · xz-utils vulnerability

This page contains facts from public vulnerability sources. Check the original advisory before updating.

It was discovered that XZ Utils incorrectly handled certain memory allocation failures when reinitializing decoders for specific compressed file formats. An attacker could possibly use this issue to trigger an invalid memory write, resulting in a denial of service or arbitrary code execution.

Fix available

Published
Updated

Stack: system

Affected products and versions

  • xz-utils Ubuntu:Pro:14.04:LTS

    Versions
    • 5.1.1alpha+20120614-2ubuntu1
    • 5.1.1alpha+20120614-2ubuntu2
    • 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm1
    • 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm2
    Affected ranges
    • ECOSYSTEM: < 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm3

    Update to 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm3

  • xz-utils Ubuntu:Pro:16.04:LTS

    Versions
    • 5.1.1alpha+20120614-2ubuntu2
    • 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm1
    • 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm2
    Affected ranges
    • ECOSYSTEM: < 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm3

    Update to 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm3

  • xz-utils Ubuntu:Pro:18.04:LTS

    Versions
    • 5.2.2-1.3
    • 5.2.2-1.3ubuntu0.1
    • 5.2.2-1.3ubuntu0.1+esm1
    Affected ranges
    • ECOSYSTEM: < 5.2.2-1.3ubuntu0.1+esm2

    Update to 5.2.2-1.3ubuntu0.1+esm2

  • xz-utils Ubuntu:Pro:20.04:LTS

    Versions
    • 5.2.4-1
    • 5.2.4-1ubuntu1
    • 5.2.4-1ubuntu1.1
    • 5.2.4-1ubuntu1.1+esm1
    Affected ranges
    • ECOSYSTEM: < 5.2.4-1ubuntu1.1+esm2

    Update to 5.2.4-1ubuntu1.1+esm2

  • xz-utils Ubuntu:22.04:LTS

    Versions
    • 5.2.5-2
    • 5.2.5-2build1
    • 5.2.5-2build2
    • 5.2.5-2ubuntu1
    • 5.2.5-2ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 5.2.5-2ubuntu1.2

    Update to 5.2.5-2ubuntu1.2

  • xz-utils Ubuntu:24.04:LTS

    Versions
    • 5.4.1-0.2
    • 5.4.4-0.1
    • 5.4.5-0.1
    • 5.4.5-0.3
    • 5.6.0-0.2
    • 5.6.1+really5.4.5-1
    • 5.6.1+really5.4.5-1build0.1
    • 5.6.1+really5.4.5-1ubuntu0.2
    • 5.6.1+really5.4.5-1ubuntu0.3
    Affected ranges
    • ECOSYSTEM: < 5.6.1+really5.4.5-1ubuntu0.4

    Update to 5.6.1+really5.4.5-1ubuntu0.4

  • xz-utils Ubuntu:26.10

    Versions
    • 5.8.3-1
    Affected ranges
    • ECOSYSTEM: < 5.8.3-1ubuntu1

    Update to 5.8.3-1ubuntu1

  • xz-utils Ubuntu:26.04:LTS

    Versions
    • 5.8.1-1build2
    • 5.8.1-2
    • 5.8.2-1
    • 5.8.2-2
    • 5.8.3-1
    Affected ranges
    • ECOSYSTEM: < 5.8.3-1ubuntu0.1

    Update to 5.8.3-1ubuntu0.1

Original sources

Check your server →