Affected: Alpaquita:23: xz, BellSoft Hardened Containers:23: xz

Affected: CleanStart: xz

Security vulnerability affects the xz package. Malicious code was discovered in the upstream tarballs of xz, starting with version 5.

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. The tarballs included extra .m4 files, which contained instructions for building with automake that did not exist in the repository. These instructions, through a series of complex obfuscations, extract a prebuilt object file from one of the test archives, which is then used to modify specific functions in the code while building the liblzma package. This issue results in liblzma being used by additional software, like sshd, to provide functionality that will be interpreted by the modified functions.

liblzma5-32bit-5.6.2-1.1 on GA media

Withdrawn by the publisher.

Affected: Ubuntu:20.04:LTS: xz-utils, Ubuntu:22.04:LTS: xz-utils, Ubuntu:24.04:LTS: xz-utils

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Debian Linux, SUSE Linux, Arch Linux, Fedora Linux, xz und Gentoo Linux ausnutzen, um beliebigen Programmcode auszuführen.