Skip to content
OpenAdvisories
High ELSA-2025-7524 1 CVE

Important: xz security update (Oracle Linux 10)

Published Jun 27, 2025 · Updated Jun 27, 2025

Ecosystem: Oracle Linux

Summary

[1:5.6.2-4]
- Fix: heap-use-after-free bug in threaded .xz decoder (CVE-2025-31115)
- Resolves: RHEL-86029

Fixed packages 4

ReleasePackageFixed in
Oracle Linux · 10 xz 1:5.6.2-4.el10_0
Oracle Linux · 10 xz-devel 1:5.6.2-4.el10_0
Oracle Linux · 10 xz-libs 1:5.6.2-4.el10_0
Oracle Linux · 10 xz-lzma-compat 1:5.6.2-4.el10_0

Vulnerabilities 1

  • High 8.7
    CVE-2025-31115

    XZ has a heap-use-after-free bug in threaded .xz decoder

    XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after fre…

    tukaani-project xz xz-utils xz Debian Ubuntu Azure Linux Alpine Hackage