Vendor

XZ Utils

1 mentions in 7 days · 1 in 30 days · 2 total · first seen Aug 17, 2026 · last 6d ago

Timeline2 articles

Fwd: XZ Utils 5.8.4 and a security fix

XZ Utils 5.8.4 fixes an invalid memory write that occurs when a decoder is reinitialized after allocation failure in 5.8.3 and older.

XZ Utils 5.8.4 has been released with a security fix for versions 5.8.3 and older. The flaw is an invalid memory write that can occur when a decoder is reinitialized after an allocation failure. The announcement was posted on the oss-security mailing list by Sam James pointing to the upstream stable release. Users and distributions running affected versions should upgrade to 5.8.4.

oss-securitySep 9, 18:28 UTC · 6d agoVulnerability

Backdoor Xz Utils Linux Open Source

Infosecurity Magazine covers the XZ Utils open-source backdoor, a malicious implant in liblzma that targeted OpenSSH on major Linux distributions.

The article covers the XZ Utils backdoor, a malicious implant introduced into the widely used open-source compression library. The compromised liblzma code manipulated functions used by OpenSSH, nearly reaching stable releases of major Linux distributions before discovery. The incident is a prominent example of software supply chain compromise targeting critical open-source infrastructure.

Infosecurity MagazineAug 17, 00:00 UTC · Aug 17, 2026Vulnerability CVE-2024-3094

Related CVEsby mentions

CVE-2024-309410.086%
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
· tukaani xz—

Appears with

organization Linux distributions 1 organization Tukaani 1 product Linux 1 product XZ Utils 1 vendor OpenSSH 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.