[<prev] [day] [month] [year] [list]
Message-ID: <87v78e8ids.fsf@gentoo.org>
Date: Wed, 09 Sep 2026 18:05:51 +0100
From: Sam James <sam@...too.org>
To: oss-security@...ts.openwall.com
Cc: Lasse Collin <lasse.collin@...aani.org>
Subject: Fwd: XZ Utils 5.8.4 and a security fix
-------------------- Start of forwarded message --------------------
Date: Wed, 9 Sep 2026 19:53:10 +0300
From: Lasse Collin <lasse.collin@...aani.org>
To: xz-devel@...aani.org
Subject: XZ Utils 5.8.4 and a security fix
XZ Utils 5.8.4 is available at <https://tukaani.org/xz/#_stable>.
In XZ Utils 5.8.3 and older, an invalid memory write can occur if a
decoder is reinitialized after allocation failure. For details, see the
security advisory:
https://tukaani.org/xz/invalid-write-after-reinit.html
This and a few other fixes have also been committed to the old stable
branches (v5.2, v5.4, and v5.6) in the xz Git repository. Those fixes
are marked below. No new 5.2.x, 5.4.x, or 5.6.x releases will be made.
5.8.4 (2026-09-09)
* liblzma:
- lzma_alone_decoder(), lzma_lzip_decoder(),
lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an
invalid memory access after memory allocation has failed and
the application reinitializes the existing decoder to decode
a different file. This bug could at least result in a crash.
This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending.
(Also in v5.2, v5.4, and v5.6.)
- lzma_stream_buffer_decode(): Fix wrong error code and,
in debug builds, assertion failure. LZMA_BUF_ERROR could
be returned with truncated inputs while LZMA_DATA_ERROR
is the correct one in this function.
(Also in v5.2, v5.4, and v5.6.)
- Fix a performance issue in the typical use case of
lzma_index_cat(). Internally liblzma calls it from
lzma_file_info_decoder(), so that was affected too. The
problem occurred if the input .xz file was created by
concatenating a large number of .xz files. A crafted file
could make "xz --list" very slow or effectively hang.
Normal decompression doesn't use these functions and
thus wasn't affected.
(Also in v5.2, v5.4, and v5.6.)
- Fix a theoretical integer overflow in lzma_index_cat().
(Also in v5.2, v5.4, and v5.6.)
- Fix bogus memory usage report in lzma_index_decoder() when
the .xz Index is obviously invalid. A huge bogus value could
cause an integer overflow in lzma_file_info_decoder()'s
memory usage reporting due to a missing overflow check,
making lzma_memused() report an incorrect tiny value. This
bug didn't affect the memory usage limiter in these two
decoders; only the reporting via lzma_memused() was affected.
(Also in v5.2, v5.4, and v5.6.)
- Fix a too low memory usage report in lzma_index_decoder()
if lzma_memused() is called after a part of the Index has
already been decoded. The typical use case is to call
lzma_memused() immediately after LZMA_MEMLIMIT_ERROR,
which did work correctly.
- Fix copying of check type in lzma_index_dup(). Calling
lzma_index_checks() on the duplicated lzma_index returned
return garbage a result. lzma_index_dup() is rarely used;
liblzma doesn't use it internally and xz itself doesn't use
it either.
(Also in v5.2, v5.4, and v5.6.)
- lzma_file_info_decoder() and lzma_index_decoder(): Reject
an obviously-invalid Number of Records field earlier.
(Partially also in v5.2, v5.4, and v5.6.)
- Fix a missing synchronization in the threaded .xz decoder. It
could make lzma_get_progress() return incorrect progress info.
(Also in v5.4 and v5.6.)
- Detect certain kinds of corrupt inputs slightly earlier in
the LZMA2 decoder.
- ARM64 and LoongArch: Don't use aligned reads on unaligned
buffers. This makes the code work on strict-align processors
and fixes a sanitizer error in other cases. (Since 5.7.1alpha)
* xz:
- Fix a use-after-free when showing an error message if --files
or --files0 was specified in the environment variables XZ_OPT
or XZ_DEFAULTS.
(Also in v5.2, v5.4, and v5.6.)
- Fix a use-after-free bug when --verbose is used and
standard error isn't a terminal. (Since 5.7.1alpha)
- Make it an error if the totals in "xz --list" exceed the range
of 64-bit integers.
(Also in v5.2, v5.4, and v5.6.)
* xz and xzdec on Linux:
- Add support for Landlock ABI version 9.
- Use fallback macros for Landlock ABI version 2, 3, and 5
(but not 4) if <linux/landlock.h> is older than ABI version 5.
This makes the binary slightly more protected if it is run on
a kernel that supports newer ABIs than <linux/landlock.h>.
* Scripts:
- xzgrep: Fix handling of the ' char at the end of a command
line option. For example, the following tricked xzgrep to
run "id": xzgrep "-e'" "-e;id;'" somefile
(Also in v5.2, v5.4, and v5.6.)
- xzdiff: Use the C locale (LC_ALL=C) with "sed" and "expr"
to ensure safe behavior with invalid multibyte sequences.
An equivalent improvement was made in xzgrep in 5.2.6
(2022-08-12), but it was forgotten from xzdiff.
(Also in v5.2, v5.4, and v5.6.)
* Tests:
- Improve a few tests and fuzz targets.
- Add new test files:
* bad-0-index-1.xz (32 bytes)
* bad-1-index-huge-uncomp.xz (72 bytes)
* Man pages:
- Improve the rendering with OpenBSD's mandoc(1).
- Reduce indentation of the tables to avoid overlong lines
in translated versions of the xz man page.
* Translations:
- In translated man pages, workaround an issue with non-ASCII
characters in tables.
- Fix syntax errors in a few man page translations.
- Update Arabic and German man page translations.
- Update Brazilian Portuguese, Croatian, Dutch, German, Italian,
Korean, Polish, Portuguese, Romanian, and Ukrainian message
translations.
--
Lasse Collin
-------------------- End of forwarded message --------------------
Download attachment "signature.asc" of type "application/pgp-signature" (419 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
