PT-2026-29689 · Xz Utils+3 · Xz Utils+3

Christos-Spearbit · CVE-2026-34743 · Publicado 2026-03-31 · Atualizado 2026-06-02

Positive Technologies (AI Summary) · Pt

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions XZ Utils versões anteriores a 5.8.3

Description XZ Utils, uma biblioteca de compressão de dados e ferramentas de linha de comando, apresentava uma falha onde a função lzma index decoder(), ao processar um Índice sem Registros, poderia deixar o lzma index em um estado que levava à alocação insuficiente de memória durante uma chamada subsequente a lzma index append(). Isso resultava em um estouro de buffer. O problema foi corrigido na versão 5.8.3.

Recommendations Atualize para a versão 5.8.3 ou posterior.

Exploit

Correção

DoS

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-122

Identificadores relacionados

BDU:2026-05834

CLEANSTART-2026-CD91667

CLEANSTART-2026-GB02436

CLEANSTART-2026-GR41888

CLEANSTART-2026-LN66182

CLEANSTART-2026-MR50866

CLEANSTART-2026-UF28691

CLEANSTART-2026-ZN45188

CVE-2026-34743

ECHO-54F0-42DA-6974

GHSA-X872-M794-CXHV

MGASA-2026-0084

OESA-2026-1853

OPENSUSE-SU-2026:10492-1

OPENSUSE-SU-2026:20813-1

RHSA-2026:7647

SUSE-SU-2026:2051-1

SUSE-SU-2026:2052-1

SUSE-SU-2026:2118-1

SUSE-SU-2026:21729-1

SUSE-SU-2026:21740-1

SUSE-SU-2026:21835-1

SUSE-SU-2026:21848-1

USN-8362-1

Produtos afetados

Linuxmint

Red Os

Ubuntu

Xz Utils

Referências · 128

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34743.json · Exploit
• https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv · Aviso do Fabricante
• https://github.com/tukaani-project/xz/releases/tag/v5.8.3 · Nota
• https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87 · Correção
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-ZN45188.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CD91667.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GR41888.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-UF28691.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LN66182.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GB02436.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-MR50866.json · Nota
• https://osv.dev/vulnerability/CVE-2025-47913 · Nota
• https://osv.dev/vulnerability/CVE-2025-61729 · Nota
• https://osv.dev/vulnerability/ghsa-9jj7-4m8r-rfcm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-47914 · Nota de Segurança