Tukaani Xz
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in Tukaani Xz.
By the Year
In 2026 there have been 0 vulnerabilities in Tukaani Xz. Xz did not have any published security vulnerabilities last year.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 0 | 0.00 |
| 2025 | 0 | 0.00 |
| 2024 | 1 | 10.00 |
| 2023 | 1 | 5.50 |
| 2022 | 1 | 8.80 |
It may take a day or so for new Xz vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Tukaani Xz Security Vulnerabilities
XZ Utils Malicious Code Linux Backdoor Attempt
CVE-2024-3094
10 - Critical
- March 29, 2024
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Embedded Malicious Code
XZ 5.2.5 Denial of Service via Crafted Decompression
CVE-2020-22916
5.5 - Medium
- August 22, 2023
An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of "endless output" and "denial of service" because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.
GNU gzip zgrep arbitrary file write via crafted multiline filenames
CVE-2022-1271
8.8 - High
- August 31, 2022
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.
Improper Input Validation
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Tukaani Xz or by Tukaani? Click the Watch button to subscribe.
