CVE-2025-31115

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-31115
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-31115.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-31115
Aliases
Related
Published
2025-04-03T17:15:30Z
Modified
2025-04-04T09:04:46.443253Z
Summary
[none]
Details

XZ Utils provide a general-purpose data-compression library plus command-line tools. In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash. The effects include heap use after free and writing to an address based on the null pointer plus an offset. Applications and libraries that use the lzmastreamdecoder_mt function are affected. The bug has been fixed in XZ Utils 5.8.1, and the fix has been committed to the v5.4, v5.6, v5.8, and master branches in the xz Git repository. No new release packages will be made from the old stable branches, but a standalone patch is available that applies to all affected releases.

References

Affected packages

Debian:12 / xz-utils

Package

Name
xz-utils
Purl
pkg:deb/debian/xz-utils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.4.1-0.2
5.4.4-0.1
5.4.5-0.1
5.4.5-0.2
5.4.5-0.3
5.5.1alpha-0.1
5.5.2beta-1
5.6.0-0.1
5.6.0-0.2
5.6.1-1
5.6.1+really5.4.5-1
5.6.2-1
5.6.2-2
5.6.3-1
5.6.4-1
5.8.0-1
5.8.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / xz-utils

Package

Name
xz-utils
Purl
pkg:deb/debian/xz-utils?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

5.*

5.4.1-0.2
5.4.4-0.1
5.4.5-0.1
5.4.5-0.2
5.4.5-0.3
5.5.1alpha-0.1
5.5.2beta-1
5.6.0-0.1
5.6.0-0.2
5.6.1-1
5.6.1+really5.4.5-1
5.6.2-1
5.6.2-2
5.6.3-1
5.6.4-1
5.8.0-1
5.8.1-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Git / github.com/tukaani-project/xz

Affected ranges

Type
GIT
Repo
https://github.com/tukaani-project/xz
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d5a2ffe41bb77b918a8c96084885d4dbe4bf6480

Affected versions

v4.*

v4.42.2alpha
v4.999.3alpha
v4.999.5alpha
v4.999.7beta
v4.999.8beta
v4.999.9beta

v5.*

v5.0.0
v5.1.0alpha
v5.1.1alpha
v5.1.2alpha
v5.1.3alpha
v5.1.4beta
v5.2.0
v5.2.1
v5.3.1alpha
v5.3.2alpha
v5.3.3alpha
v5.3.4alpha
v5.3.5beta
v5.4.0
v5.5.0alpha
v5.5.1alpha
v5.5.2beta
v5.7.0alpha
v5.7.1alpha
v5.7.2beta
v5.8.0