Skip to content
OpenAdvisories

Package · Alpine

xz

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • Low 1.7
    CVE-2026-34743

    XZ Utils: Buffer overflow in lzma_index_append()

    XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent l…

    tukaani-project xz xz xz-utils Debian Ubuntu Alpine
  • High 8.7
    CVE-2025-31115

    XZ has a heap-use-after-free bug in threaded .xz decoder

    XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after fre…

    tukaani-project xz xz xz-utils Debian Ubuntu Alpine Hackage
  • Critical 10.0
    CVE-2024-3094 Public exploit EPSS 91%

    Xz: malicious code in distributed source

    Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is the…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Alpine
  • High 8.8
    CVE-2022-1271

    An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's ch…

    gzip xz-utils xz xz-utils Debian Ubuntu Alpine