Cleemy Desu Wayo discovered that XZ Utils incorrectly handled certain filenames. If a user or automated system were tricked into performing xzgrep operations with specially crafted filenames, a remote attacker could overwrite arbitrary files.
{ "availability": "No subscription required", "binaries": [ { "xzdec-dbgsym": "5.2.2-1.3ubuntu0.1", "liblzma5-dbgsym": "5.2.2-1.3ubuntu0.1", "liblzma5": "5.2.2-1.3ubuntu0.1", "liblzma-doc": "5.2.2-1.3ubuntu0.1", "xz-utils": "5.2.2-1.3ubuntu0.1", "xz-utils-dbgsym": "5.2.2-1.3ubuntu0.1", "xzdec": "5.2.2-1.3ubuntu0.1", "liblzma-dev": "5.2.2-1.3ubuntu0.1" } ] }
{ "availability": "No subscription required", "binaries": [ { "xzdec-dbgsym": "5.2.4-1ubuntu1.1", "liblzma5-dbgsym": "5.2.4-1ubuntu1.1", "liblzma5": "5.2.4-1ubuntu1.1", "liblzma-doc": "5.2.4-1ubuntu1.1", "xz-utils": "5.2.4-1ubuntu1.1", "xz-utils-dbgsym": "5.2.4-1ubuntu1.1", "xzdec": "5.2.4-1ubuntu1.1", "liblzma-dev": "5.2.4-1ubuntu1.1" } ] }