Your message dated Sat, 12 Sep 2026 10:40:46 +0000
with message-id <[email protected]>
and subject line Bug#1147318: fixed in xz-utils 5.8.4-1
has caused the Debian Bug report #1147318,
regarding xz-utils: GHSA-5qpq-xqfv-j9pg: Invalid write if a decoder is
reinitialized after allocation failure
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1147318: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1147318
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: xz-utils
Version: 5.8.3-1
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi
As per https://tukaani.org/xz/invalid-write-after-reinit.html and
https://github.com/tukaani-project/xz/security/advisories/GHSA-5qpq-xqfv-j9pg
| In XZ Utils 5.8.3 and older, an invalid memory write can occur in
| decoders that are initialized using the following functions:
|
| lzma_alone_decoder (decodes .lzma files)
|
| lzma_lzip_decoder (decodes .lz files)
|
| lzma_auto_decoder (when decoding .lzma or .lz files)
|
| lzma_microlzma_decoder (decodes MicroLZMA format)
|
| Required steps:
|
| A lzma_stream is initialized using one of the above functions.
|
| A file is decoded at least partially.
|
| The same lzma_stream is reinitialized using the same function.
|
| Another file is decoded but memory allocation fails with
| LZMA_MEM_ERROR. (LZMA_MEMLIMIT_ERROR doesn’t cause this.)
|
| The same lzma_stream is reinitialized again using the same function.
|
| A file is decoded. It must specify the same dictionary size as the
| file in step 2.
|
| Decoders for the .xz format and raw streams aren’t affected.
|
| The issue has been fixed in XZ Utils 5.8.4 and in the Git repository
| branch v5.8. The fix is also in the Git repository branches v5.6,
| v5.4, and v5.2, but no new releases will be made from these old
| branches.
|
| The bug was reported and discovered by Cantina using their AppSec
| agent, Apex.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: xz-utils
Source-Version: 5.8.4-1
Done: Otto Kekäläinen <[email protected]>
We believe that the bug you reported is fixed in the latest version of
xz-utils, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Otto Kekäläinen <[email protected]> (supplier of updated xz-utils package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 09 Sep 2026 18:18:18 +0000
Source: xz-utils
Architecture: source
Version: 5.8.4-1
Distribution: unstable
Urgency: medium
Maintainer: Sebastian Andrzej Siewior <[email protected]>
Changed-By: Otto Kekäläinen <[email protected]>
Closes: 1147318
Changes:
xz-utils (5.8.4-1) unstable; urgency=medium
.
* Import 5.8.4
- See notes https://github.com/tukaani-project/xz/releases/tag/v5.8.4
- Includes security fix for GHSA-5qpq-xqfv-j9pg (Closes: #1147318)
* Drop man page syntax patch now mostly addressed upstream
* Backport upstream commit to fix test_files.sh failure with --disable-xz
* Bump Debhelper version from 13 to 14
* Bump Debian Policy version to 4.7.4
Checksums-Sha1:
cacbf313039bf4ed544267ad6a41553f554a3afb 2476 xz-utils_5.8.4-1.dsc
b1345221051ef5ac65297926418b56d2b941fe64 1567192 xz-utils_5.8.4.orig.tar.xz
7c63f706ba59085b6f16d3ea3945c5c00ddeac0d 27120 xz-utils_5.8.4-1.debian.tar.xz
b5738c52f710faf6c0f844c95b190e42c72ad164 5454 xz-utils_5.8.4-1_source.buildinfo
Checksums-Sha256:
5901f80e56358c0c1418513091b15cc5de0a9492a363d9e42108dfd77f38f07f 2476
xz-utils_5.8.4-1.dsc
4ce24038fd4221e0d13bc1a2de7a4db56e90b92b3bf75321f6c14be73f65de4b 1567192
xz-utils_5.8.4.orig.tar.xz
79d5dca2beef9ede917a41fee584edae9d2ffad004f73c71d51b1548b1af9bbd 27120
xz-utils_5.8.4-1.debian.tar.xz
f4acade1ea49a69a4345eb76603118d50b398ebc4864b2b9e0207eabc07d448c 5454
xz-utils_5.8.4-1_source.buildinfo
Files:
9a80dad783e61ad1962d028b58016ddb 2476 utils optional xz-utils_5.8.4-1.dsc
8b2f092ad33e560bc04ffdbe3101daa7 1567192 utils optional
xz-utils_5.8.4.orig.tar.xz
095d0442ebd0587ee9ded8680501e4f9 27120 utils optional
xz-utils_5.8.4-1.debian.tar.xz
1c6e87139cf8ba53f02276f25fbfc480 5454 utils optional
xz-utils_5.8.4-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEmbRSsR88dMO0U+RvvthEn87o2ogFAmqlJSMACgkQvthEn87o
2ohfhw//TlehHAfesKQVs1wbMqKeKOa71RZugDEWB+10CYRg5UpUapmW5t3+PzmZ
GM2HleE0KYbtFUI/O10Iwhy6K8+sqN1yIecrQ7bA3fSQOIDgo+3ZxdHczG8mqnK4
Ah6cE30eAcxg019Nuefv2aAKO1CwyACmWQzjdZUhNg63MD4Heb8fQ+6dx/LrvpCW
Od1EYBViKXBwpMxhuRLePZim91Y2AcWAwTTX0BE0SiR28QUfMgzT9i9J9W2tLY48
7LI8/O1cy3xVYWEYPSAQFcyW1MzdnchsJOeCcGjX0WgTL44be3wWOlIwgrtYA4m/
9zgPw80b2lckHBfNe4l9IvGA6gze1Ix4rCDuXY2gbuS83vmF+rTvT0bSN4YTMCgE
EdOSrR9ojeSzIsuuPxEI4TSGQX/pnIwmT0qbXkODOqg1ZMHa9AwkdD65CibIEfQZ
KyeBL+CmQy0SwgfTqIq7IBKRLgb8JBt4feywhOj0B3/qiiW8g3nHs7cEhhiSsl9T
6UmpZsF9e8uaDFzLL1xXBAizNt0dyEaPpBQ5ioBXprvewMBgqJyBWMqdxQMLaDBs
WrI7IxHgQwxecaK5WDk+I5X/ifbsONL3zrkRHH2Dx2pXXdXP3RdNMUOPz5UtwwjB
TGdzJ5C0F3ebOjUIB2wL0xAO/UsmWlpribRh/jx4W/O49qOw8LI=
=TrkN
-----END PGP SIGNATURE-----
pgpDUHj0LJ_J_.pgp
Description: PGP signature
--- End Message ---
