Xz vulnerabilities

2 known vulnerabilities in Xz from Tukaani. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 10.0 Critical severity

  Red Hat Enterprise Linux 10: Embedded Malicious Code

  CVE-2024-3094Mar 29, 2024Red HatEPSS 90.9%

  Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then

• 8.8 High severity

  An arbitrary file write vulnerability was found in GNU gzip's zgrep utility.

  CVE-2022-1271Aug 31, 2022Gzip, Xz-utilsEPSS 5.55%

  An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw