TI-2024-02898 CVE-2024-3094 · GHSA-rxwq-x6h5-x525
Xz: malicious code in distributed source
Priority CRITICAL 92
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.
Tukaani
Records5All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical1CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
Tukaani records in CISA KEVNo Tukaani vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
5 records
TI-2022-01156 CVE-2022-1271 · GHSA-jrpw-543v-8r62
Improper input validation in gzip, xz-utils
Priority MEDIUM 49
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility.
TI-2015-03402 CVE-2015-4035 · GHSA-mf33-8p24-6h53
scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process…
Priority LOW 36
scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted fi…
TI-2020-14422 CVE-2020-22916 · GHSA-8rm5-v9qv-hvcc
An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via…
Priority LOW 24
An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file.
Priority LOW 16
XZ Utils provide a general-purpose data-compression library plus command-line tools.