PT-2024-32672 · Xz Utils · Xz Utils

Splitline · Published 2024-10-02 · Updated 2026-03-29 · CVE-2024-47611

Positive Technologies (AI Summary)

CVSS v4.0

6.3

Medium

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions XZ Utils versions 5.6.2 and older

Description The issue concerns a command line argument injection vulnerability in XZ Utils when built for native Windows. This occurs when Unicode characters in filenames are converted to similar-looking ASCII characters, potentially changing the command line's meaning and allowing for argument injection or directory traversal attacks. The estimated number of potentially affected devices is not specified.

Recommendations For versions 5.6.2 and older, update to version 5.6.3 or newer to resolve the issue. As a temporary workaround, consider avoiding the use of Unicode characters in filenames for command line tools until a patch is applied. Restrict access to sensitive directories to minimize the risk of directory traversal attacks.

Exploit

Fix

Argument Injection

Weakness Enumeration

CWE-88

CWE-176

Related Identifiers

CVE-2024-47611

GHSA-M538-C5QW-3CG4

Affected Products

Xz Utils

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47611.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-47611 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-ALPINE-320-CVE-2024-47611 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-ALPINE-319-CVE-2024-47611 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-ALPINE-318-CVE-2024-47611 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47611 · Security Note
• https://github.com/tukaani-project/xz/security/advisories/GHSA-m538-c5qw-3cg4 · Note
• https://github.com/tukaani-project/xz/commit/bf518b9ba446327a062ddfe67e7e0a5baed2394f · Note
• https://twitter.com/CVEnew/status/1841486668529844262 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1841517827347423725 · Twitter Post
• https://t.me/cvedetector/6832 · Telegram Post
• https://twitter.com/oktsec/status/1841503093453672586 · Twitter Post