Summary
XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv-Markov chain algorithm (LZMA), which performs lossless data compression. The algorithm provides a high compression ratio while keeping the decompression time short.
Security Fix(es):
* xz: XZ has a heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 10 | xz | 1:5.6.2-4.el10_0 |
| AlmaLinux · 10 | xz-devel | 1:5.6.2-4.el10_0 |
| AlmaLinux · 10 | xz-libs | 1:5.6.2-4.el10_0 |
| AlmaLinux · 10 | xz-lzma-compat | 1:5.6.2-4.el10_0 |
Vulnerabilities 1
-
High 8.7
XZ has a heap-use-after-free bug in threaded .xz decoder
XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after fre…