EUVD-2025-28310

Malicious code in bioql PyPI...

EUVD-2023-43443

Malicious code in bioql PyPI...

EUVD-2022-55457

Malicious code in bioql PyPI...

EUVD-2025-13115

Malicious code in bioql PyPI...

SUSE SLES15: warewulf4 / warewulf4-dracut / warewulf4-man / warewulf4-overlay / etc (SUSE-SU-2025:03448-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03448-1 advisory. Update to version 4.6.4. Security issues fixed: - CVE-2025-58058: xz: excessive memory consuption when unpacking a large number of...

Security update for warewulf4

This update for warewulf4 fixes the following issues: Update to version 4.6.4. Security issues fixed: CVE-2025-58058: xz: excessive memory consuption when unpacking a large number of corrupted LZMA archives bsc1248906. Other issues fixed: Convert disk booleans from wwbool to bool which allows boo...

Allocation Of Resources Without Limits

github.com/ulikunitz/xz is vulnerable to Allocation Of Resources Without Limits. The vulnerability is due to denial of service due to improper header validation that allows arbitrary data to be prepended to an LZMA stream, causing the implementation to allocate a full decode buffer and consume...

GO-2025-3922 Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz

Memory leaks when decoding a corrupted multiple LZMA archives in github.com/ulikunitz/xz...

Linux Distros Unpatched Vulnerability : CVE-2023-39743

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3decodeblock src/libbz3.c. CVE-2023-39743 Note that Nessus relies on t...

github.com/ulikunitz/xz leaks memory when decoding a corrupted multiple LZMA archives

...

A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.

...

Linux Distros Unpatched Vulnerability : CVE-2025-58058

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte...

CVE-2025-58058

A memory leak flaw has been discovered in the golang github.com/ulikunitz/xz package. In affected versions, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the curren...

SUSE CVE-2025-58058

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current...

AZL-66723 CVE-2025-58058 affecting package cri-o for versions less than 1.22.3-16

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current...

AZL-66720 CVE-2025-58058 affecting package containerized-data-importer for versions less than 1.55.0-25

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current...

AZL-66741 CVE-2025-58058 affecting package packer for versions less than 1.9.5-15

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current...

AZL-66735 CVE-2025-58058 affecting package jx for versions less than 3.2.236-23

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current...

AZL-66731 CVE-2025-58058 affecting package podman for versions less than 5.6.1-2

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current...

AZL-66759 CVE-2025-58058 affecting package packer for versions less than 1.9.5-10

xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current...