Skip to content
NewA calmer, faster ZeroHour
Vulnerabilitymedium

Fwd: XZ Utils 5.8.4 and a security fix

oss-security ()1
Read at seclists.org
AI summary · glm-5.3-flashSummaries by Vani AI

XZ Utils 5.8.4 fixes an invalid memory write that occurs when a decoder is reinitialized after allocation failure in 5.8.3 and older.

XZ Utils 5.8.4 has been released with a security fix for versions 5.8.3 and older. The flaw is an invalid memory write that can occur when a decoder is reinitialized after an allocation failure. The announcement was posted on the oss-security mailing list by Sam James pointing to the upstream stable release. Users and distributions running affected versions should upgrade to 5.8.4.

Key facts
  • Fixed in XZ Utils 5.8.4; affected versions are 5.8.3 and older.
  • Triggered when a decoder is reinitialized following an allocation failure.
  • Announced via the oss-security mailing list with details on the Tukaani project page.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
decompressionmemory-corruptionoss-securitypatchxz-utils
Vendors
XZ Utils
Products
XZ Utils
Organizations
Tukaani

From the original article

Posted by Sam James on Sep 09 -------------------- Start of forwarded message -------------------- https://tukaani. org/xz/#_stable>. In XZ Utils 5.

oss-security

seclists.org

Read the full article at oss-security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.