PT-2026-29689 · Xz Utils+3 · Xz Utils+3

Christos-Spearbit · Publicado 2026-03-31 · Atualizado 2026-06-02 · CVE-2026-34743

Positive Technologies (AI Summary) · Pt

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions XZ Utils versões anteriores a 5.8.3

Description XZ Utils, uma biblioteca de compressão de dados e ferramentas de linha de comando, apresentava uma falha onde a função lzma index decoder(), ao processar um Índice sem Registros, poderia deixar o lzma index em um estado que levava à alocação insuficiente de memória durante uma chamada subsequente a lzma index append(). Isso resultava em um estouro de buffer. O problema foi corrigido na versão 5.8.3.

Recommendations Atualize para a versão 5.8.3 ou posterior.

Correção

DoS

Heap Based Buffer Overflow

Enumeração de Fraquezas

CWE-122

Identificadores relacionados

BDU:2026-05834

CLEANSTART-2026-CD91667

CLEANSTART-2026-GB02436

CLEANSTART-2026-GR41888

CLEANSTART-2026-LN66182

CLEANSTART-2026-MR50866

CLEANSTART-2026-UF28691

CVE-2026-34743

ECHO-54F0-42DA-6974

MGASA-2026-0084

OESA-2026-1853

OPENSUSE-SU-2026:10492-1

RHSA-2026:7647

USN-8362-1

Produtos afetados

Linuxmint

Red Os

Ubuntu

Xz Utils

Referências · 122

• https://github.com/tukaani-project/xz/releases/tag/v5.8.3 · Nota
• https://github.com/tukaani-project/xz/commit/c8c22869e780ff57c96b46939c3d79ff99395f87 · Correção
• https://github.com/tukaani-project/xz/security/advisories/GHSA-x872-m794-cxhv · Aviso do Fabricante
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-CD91667.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GR41888.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-MR50866.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-UF28691.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LN66182.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GB02436.json · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-25210 · Nota de Segurança
• https://osv.dev/vulnerability/ghsa-pc3f-x583-g7j2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-27143 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2025-58181 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-61729 · Nota
• https://twitter.com/oss_security/status/2039551983070134774 · Publicação no Twitter