XZ Utils mishandles decoder memory failures, risking code execution
Original title: USN-8945-1: XZ Utils vulnerability
Ubuntu's USN-8945-1 says a bad write during decoder reinitialization could cause denial of service or arbitrary code execution.
Ubuntu notice USN-8945-1 says XZ Utils incorrectly handled certain memory allocation failures when reinitializing decoders for specific compressed file formats. An attacker could possibly use the issue to trigger an invalid memory write, causing denial of service or arbitrary code execution. The excerpt names no CVE, affected versions, fixed release, or exploitation status.
Unconfirmed: The excerpt does not state a CVE, versions, a fix, or whether the issue is exploited.
- The flaw is in reinitializing decoders after certain allocation failures.
- It applies to specific compressed file formats, which the excerpt does not name.
- Ubuntu describes the outcome as a possible invalid memory write.
Impact: invalid memory write, denial of service or code execution
| Product | Affected |
|---|---|
| XZ Utils | — |
From the original article
It was discovered that XZ Utils incorrectly handled certain memory allocation failures when reinitializing decoders for specific compressed file formats. An attacker could possibly use this issue to trigger an invalid memory write, resulting in a denial of service or arbitrary code execution.
ubuntu.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.