Source: xz-utils Version: 5.8.3-1 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi As per https://tukaani.org/xz/invalid-write-after-reinit.html and https://github.com/tukaani-project/xz/security/advisories/GHSA-5qpq-xqfv-j9pg | In XZ Utils 5.8.3 and older, an invalid memory write can occur in | decoders that are initialized using the following functions: | | lzma_alone_decoder (decodes .lzma files) | | lzma_lzip_decoder (decodes .lz files) | | lzma_auto_decoder (when decoding .lzma or .lz files) | | lzma_microlzma_decoder (decodes MicroLZMA format) | | Required steps: | | A lzma_stream is initialized using one of the above functions. | | A file is decoded at least partially. | | The same lzma_stream is reinitialized using the same function. | | Another file is decoded but memory allocation fails with | LZMA_MEM_ERROR. (LZMA_MEMLIMIT_ERROR doesn’t cause this.) | | The same lzma_stream is reinitialized again using the same function. | | A file is decoded. It must specify the same dictionary size as the | file in step 2. | | Decoders for the .xz format and raw streams aren’t affected. | | The issue has been fixed in XZ Utils 5.8.4 and in the Git repository | branch v5.8. The fix is also in the Git repository branches v5.6, | v5.4, and v5.2, but no new releases will be made from these old | branches. | | The bug was reported and discovered by Cantina using their AppSec | agent, Apex. Regards, Salvatore
