Linux Distros Unpatched Vulnerability : CVE-2022-47112

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - 7-Zip 22.01 does not report an error for certain invalid xz files, involving stream flags and reserved bits. Some later versions are unaffected. CVE-2022-47112...

Beneath the Mask: Can Contribution Data Unveil Malicious Personas in Open-Source Projects?

In February 2024, after building trust over two years with project maintainers by making a significant volume of legitimate contributions, GitHub user "JiaT75" self-merged a version of the XZ Utils project containing a highly sophisticated, well-disguised backdoor targeting sshd processes running...

Linux Distros Unpatched Vulnerability : CVE-2021-29482

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xz is a compression and decompression library focusing on the xz format completely written in Go. The function readUvarint used to read the xz container format...

Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Images, Fueling Supply Chain Risks

New research has uncovered Docker images on Docker Hub that contain the infamous XZ Utils backdoor, more than a year after the discovery of the incident. More troubling is the fact that other images have been built on top of these infected base images, effectively propagating the infection furthe...

Researchers Spot XZ Utils Backdoor in Dozens of Docker Hub Images, Fueling Supply Chain Risks

New research has uncovered Docker images on Docker Hub that contain the infamous XZ Utils backdoor, more than a year after the discovery of the incident. More troubling is the fact that other images have been built on top of these infected base images, effectively propagating the infection furthe...

ROOT-OS-ALPINE-319-CVE-2024-47611 CVE-2024-47611 in rootio-xz - Patched by Root

Root has patched CVE-2024-47611 in the rootio-xz package for Root:Alpine:3.19. Multiple fixed versions available...

ROOT-OS-ALPINE-318-CVE-2024-47611 CVE-2024-47611 in rootio-xz - Patched by Root

Root has patched CVE-2024-47611 in the rootio-xz package for Root:Alpine:3.18. Multiple fixed versions available...

Security update for xz

This update for xz fixes the following issues: CVE-2025-31115: Fixed heap use after free and writing to an address based on the null pointer plus an offset bsc1240414 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper...

SUSE-SU-2025:20590-1 Security update for xz

This update for xz fixes the following issues: - CVE-2025-31115: Fixed heap use after free and writing to an address based on the null pointer plus an offset bsc1240414...

SUSE-SU-2025:20553-1 Security update for xz

This update for xz fixes the following issues: - CVE-2025-31115: Fixed heap use after free and writing to an address based on the null pointer plus an offset bsc1240414...

FreeBSD : FreeBSD -- Use-after-free in multi-threaded xz decoder (7642ba72-5abf-11f0-87ba-002590c1f29c)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 7642ba72-5abf-11f0-87ba-002590c1f29c advisory. A worker thread could free its input buffer after decoding, while the main thread might still be writin...

K000152366: XZ Utils vulnerability CVE-2025-31115

Security Advisory Description XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and...

FreeBSD -- Use-after-free in multi-threaded xz decoder

Problem Description: A worker thread could free its input buffer after decoding, while the main thread might still be writing to it. This leads to an use-after-free condition on heap memory. Impact: An attacker may use specifically crafted .xz file to cause multi-threaded xz decoder to crash, or...

FreeBSD-SA-25:06.xz

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-25:06.xz Security Advisory The FreeBSD Project Topic: Use-after-free in multi-threaded xz decoder Category: contrib Module: xz Announced: 2025-07-02 Affects:...

Oracle Linux 10 : xz (ELSA-2025-7524)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-7524 advisory. - Fix: heap-use-after-free bug in threaded .xz decoder CVE-2025-31115 Tenable has extracted the preceding description block directly from the Oracle Linux...

Exploit for Embedded Malicious Code in Tukaani Xz

Threat Intelligence Report: CVE-2024-3094 – XZ Utils Backdoor...

Astra Linux – Vulnerability in xz-utils

XZ Utils provides a general-purpose data-compression library along with command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, there is a bug in the multithreaded .xz decoder in liblzma: invalid inputs can potentially cause a crash. The effects of this bug include heap usage after deallocation, as...

RHEL 10 : xz (RHSA-2025:7524)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:7524 advisory. XZ Utils is an integrated collection of user-space file compression utilities based on the Lempel-Ziv- Markov chain algorithm LZMA, which performs...

SUSE: Security Advisory (SUSE-SU-2025:1137-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-7f00e5e744)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...