GLSA 202504-01: XZ Utils: Use after free

http://security.gentoo.org/

Severity:	normal
Title:	XZ Utils: Use after free
Date:	04/05/2025
Bugs:	#953086
ID:	202504-01

Synopsis

A vulnerability has been discovered in XZ Utils, which could lead to denial of service.

Background

XZ Utils is free general-purpose data compression software with a high compression ratio.

Affected packages

Package	Vulnerable	Unaffected	Architecture(s)
app-arch/xz-utils	< 5.6.4-r1	>= 5.6.4-r1	All supported architectures

Description

A use-after-free has been discovered in XZ utils. Please review the CVE identifier referenced below for details.

Impact

The multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzma_stream_decoder_mt function are affected. It's unlikely one can achieve more than a crash if xz is built with PIE on a 64-bit system especially, as is done in Gentoo by default.

Workaround

There is no known workaround at this time.

Resolution

All XZ utils users should upgrade to the latest version:

          # emerge --sync
          # emerge --ask --oneshot --verbose ">=app-arch/xz-utils-5.6.4-r1"

References

CVE-2025-31115

Availability

This GLSA and any updates to it are available for viewing at the Gentoo Security Website: http://security.gentoo.org/glsa/glsa-202504-01.xml

Concerns?

Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users machines is of utmost importance to us. Any security concerns should be addressed to security@gentoo.org or alternatively, you may file a bug at https://bugs.gentoo.org.