Skip to content
OpenAdvisories
High RHSA-2025:7524 1 CVE

Red Hat Security Advisory: xz security update

Published May 14, 2025 · Updated Sep 1, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 10 enterprise_linux:10.0 xz 1:5.6.2-4.el10_0
Red Hat · RHEL 10 enterprise_linux:10.0 xz-debuginfo 1:5.6.2-4.el10_0
Red Hat · RHEL 10 enterprise_linux:10.0 xz-debugsource 1:5.6.2-4.el10_0
Red Hat · RHEL 10 enterprise_linux:10.0 xz-devel 1:5.6.2-4.el10_0
Red Hat · RHEL 10 enterprise_linux:10.0 xz-libs 1:5.6.2-4.el10_0
Red Hat · RHEL 10 enterprise_linux:10.0 xz-libs-debuginfo 1:5.6.2-4.el10_0
Red Hat · RHEL 10 enterprise_linux:10.0 xz-lzma-compat 1:5.6.2-4.el10_0
Red Hat · RHEL 10 enterprise_linux:10.0 xz-lzma-compat-debuginfo 1:5.6.2-4.el10_0

Vulnerabilities 1

  • High 8.7
    CVE-2025-31115

    XZ has a heap-use-after-free bug in threaded .xz decoder

    XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after fre…

    tukaani-project xz xz-utils xz Debian Ubuntu Azure Linux Alpine Hackage

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2357249
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7524.json
  • report
    https://access.redhat.com/security/cve/CVE-2025-31115
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2025-31115
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2025-31115
  • article
    https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4bf6480
  • article
    https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2
  • article
    https://tukaani.org/xz/xz-cve-2025-31115.patch