Summary
It was discovered that XZ Utils incorrectly handled certain memory
allocation failures when reinitializing decoders for specific compressed
file formats. An attacker could possibly use this issue to trigger an
invalid memory write, resulting in a denial of service or arbitrary code
execution.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | xz-utils | 5.2.5-2ubuntu1.2 |
| Ubuntu · 24.04 LTS 24.04:LTS | xz-utils | 5.6.1+really5.4.5-1ubuntu0.4 |
| Ubuntu · 26.04 LTS 26.04:LTS | xz-utils | 5.8.3-1ubuntu0.1 |
| Ubuntu · 26.10 | xz-utils | 5.8.3-1ubuntu1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | xz-utils | 5.1.1alpha+20120614-2ubuntu2.14.04.1+esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | xz-utils | 5.1.1alpha+20120614-2ubuntu2.16.04.1+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | xz-utils | 5.2.2-1.3ubuntu0.1+esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | xz-utils | 5.2.4-1ubuntu1.1+esm2 |
References
-
report
https://bugs.launchpad.net/bugs/2170056