Описание
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
A flaw was found in XZ Utils. When the lzma_index_decoder() function processes an empty index, and a subsequent lzma_index_append() operation is performed, insufficient memory is allocated. This can lead to a buffer overflow, potentially causing a denial of service (DoS) for affected systems.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 6 | xz | Out of support scope | ||
| Red Hat Enterprise Linux 7 | xz | Fix deferred | ||
| Red Hat Enterprise Linux 8 | xz | Fix deferred | ||
| Red Hat Enterprise Linux 9 | xz | Affected | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-8 | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | openshift/ose-rhel-coreos-9 | Fix deferred | ||
| Red Hat Enterprise Linux 10 | xz | Fixed | RHSA-2026:64787 | 08.09.2026 |
| Red Hat Hardened Images | xz-main-5.8.3-1.1.hum1 | Fixed | RHSA-2026:7647 | 11.04.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
XZ Utils provide a general-purpose data-compression library plus comma ...
EPSS
5.3 Medium
CVSS3