Re: CVE-2024-3094: malicious code in xz 5.6.0 and xz 5.6.1

2024-04-04 Thread Ben C. O. Grimm
On April 4, 2024 07:50:55 FreeBSD User wrote: Hello, I just stumbled over this CVE regarding xz 5.6.0 and 5.6.1: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3094 FreeBSD starting with 14-STABLE seems to use xz 5.6.0, but my limited skills do not allow me to judge wether the

Re: CVE-2024-3094: malicious code in xz 5.6.0 and xz 5.6.1

2024-04-04 Thread Kyle Evans
On 4/4/24 00:49, FreeBSD User wrote: Hello, I just stumbled over this CVE regarding xz 5.6.0 and 5.6.1: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3094 FreeBSD starting with 14-STABLE seems to use xz 5.6.0, but my limited skills do not allow me to judge wether the described

Re: CVE-2024-3094: malicious code in xz 5.6.0 and xz 5.6.1

2024-04-04 Thread FreeBSD User
Am Thu, 04 Apr 2024 08:06:26 +0200 (CEST) sth...@nethelp.no schrieb: > >> I have to report to my superiors (we're using 14-STABLE and CURRENT > >> and I do so in private), > >> so I would like to welcome any comment on that. > > > > No it does not affect FreeBSD. > > > > The autoconf script

Re: CVE-2024-3094: malicious code in xz 5.6.0 and xz 5.6.1

2024-04-04 Thread sthaug
>> I have to report to my superiors (we're using 14-STABLE and CURRENT >> and I do so in private), >> so I would like to welcome any comment on that. > > No it does not affect FreeBSD. > > The autoconf script checks that it is running in a RedHat or Debian > package build environment before

Re: CVE-2024-3094: malicious code in xz 5.6.0 and xz 5.6.1

2024-04-04 Thread Paul Floyd
On 04-04-24 05:49, FreeBSD User wrote: Hello, I just stumbled over this CVE regarding xz 5.6.0 and 5.6.1: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3094 FreeBSD starting with 14-STABLE seems to use xz 5.6.0, but my limited skills do not allow me to judge whether the