Catalogo CVE

CVE-2024-3094

XZ Utils and the liblzma supply-chain backdoor

Malicious XZ Utils 5.6.0 and 5.6.1 release tarballs could produce a backdoored liblzma. Exposure depends on the source, build, and distribution package, not the version label alone.

Gravità: Critical · CVSS 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published: Mar 29, 2024, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 90.90% · Oct 27, 2026

Original advisory description

Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.

Projects and upstream resources

[xz][Project homepage][Source repository][XZ incident report]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	xz-utils	`5.8.1-1+deb13u2`	Fixed	[CVE-2024-3094]
Debiantrixie	xz-utils	`5.6.1+really5.4.5-1`	FixedDistribution-reported fixed boundary	[CVE-2024-3094]
Debiantrixie	xz-utils	`5.8.1-1+deb13u1`	Fixed	[CVE-2024-3094]
Debiansid	xz-utils	`5.6.1+really5.4.5-1`	FixedDistribution-reported fixed boundary	[CVE-2024-3094]
Debiansid	xz-utils	`5.8.4-1`	Fixed	[CVE-2024-3094]
Debianforky	xz-utils	`5.6.1+really5.4.5-1`	FixedDistribution-reported fixed boundary	[CVE-2024-3094]
Debianforky	xz-utils	`5.8.4-1`	Fixed	[CVE-2024-3094]
Alpine3.24	xz	`5.6.1-r2`	Fixed	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.23	xz	`5.6.1-r2`	Fixed	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.22	xz	`5.6.1-r2`	Fixed	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.21	xz	`5.6.1-r2`	Fixed	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.20	xz	`5.6.1-r2`	Fixed	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC

Showing 12 fix observations. All 21 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
UnknownRelease not reported	xz-utils	Not reported	UnknownSource applicability is not established	Provider not reported
Alpine3.15	lighttpd	`1.4.76-r0`	UnknownThe retained Alpine OSV record maps this XZ/liblzma CVE to lighttpd. Applicability is unverified; this row is excluded from fix guidance.	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.16	lighttpd	`1.4.76-r0`	UnknownThe retained Alpine OSV record maps this XZ/liblzma CVE to lighttpd. Applicability is unverified; this row is excluded from fix guidance.	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.17	lighttpd	`1.4.76-r0`	UnknownThe retained Alpine OSV record maps this XZ/liblzma CVE to lighttpd. Applicability is unverified; this row is excluded from fix guidance.	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.18	lighttpd	`1.4.76-r0`	UnknownThe retained Alpine OSV record maps this XZ/liblzma CVE to lighttpd. Applicability is unverified; this row is excluded from fix guidance.	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.20	xz	`5.6.1-r2`	Fixed	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.21	xz	`5.6.1-r2`	Fixed	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.22	xz	`5.6.1-r2`	Fixed	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.23	xz	`5.6.1-r2`	Fixed	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Alpine3.24	xz	`5.6.1-r2`	Fixed	[ALPINE-CVE-2024-3094]Sep 15, 2026, 8:17:48 AM UTC
Debianbookworm	xz-utils	Not reported	Not affectedDistribution reports not affected	[CVE-2024-3094]
Debianbookworm	xz-utils	`5.4.1-1+deb12u1`	Not affected	[CVE-2024-3094]
Debianbookworm-security	xz-utils	`5.4.1-1+deb12u2`	Not affected	[CVE-2024-3094]
Debianforky	xz-utils	`5.6.1+really5.4.5-1`	FixedDistribution-reported fixed boundary	[CVE-2024-3094]
Debianforky	xz-utils	`5.8.4-1`	Fixed	[CVE-2024-3094]
Debiansid	xz-utils	`5.6.1+really5.4.5-1`	FixedDistribution-reported fixed boundary	[CVE-2024-3094]
Debiansid	xz-utils	`5.8.4-1`	Fixed	[CVE-2024-3094]
Debiantrixie	xz-utils	`5.6.1+really5.4.5-1`	FixedDistribution-reported fixed boundary	[CVE-2024-3094]
Debiantrixie	xz-utils	`5.8.1-1+deb13u1`	Fixed	[CVE-2024-3094]
Debiantrixie-security	xz-utils	`5.8.1-1+deb13u2`	Fixed	[CVE-2024-3094]
Opensusetumbleweed	xz	`5.6.2-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2024:14017-1]Feb 4, 2026, 4:17:49 AM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "xz-utils",
      "status": "fixed",
      "release": "sid",
      "version": "5.8.4-1"
    },
    {
      "name": "xz-utils",
      "status": "fixed",
      "release": "forky",
      "version": "5.8.4-1"
    },
    {
      "name": "xz-utils",
      "status": "fixed",
      "release": "trixie",
      "version": "5.8.1-1+deb13u1"
    },
    {
      "name": "xz-utils",
      "status": "fixed",
      "release": "trixie-security",
      "version": "5.8.1-1+deb13u2"
    },
    {
      "name": "xz-utils",
      "status": "not affected",
      "release": "bookworm",
      "version": "5.4.1-1+deb12u1"
    },
    {
      "name": "xz-utils",
      "status": "not affected",
      "release": "bookworm-security",
      "version": "5.4.1-1+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "xz-utils",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "5.6.1+really5.4.5-1"
    },
    {
      "bug": null,
      "name": "xz-utils",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "5.6.1+really5.4.5-1"
    },
    {
      "bug": null,
      "name": "xz-utils",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "5.6.1+really5.4.5-1"
    },
    {
      "bug": null,
      "name": "xz-utils",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "unimportant",
      "fixed_version": "0"
    }
  ],
  "distribution_packages": [
    {
      "name": "xz-utils",
      "fixed_version": "0",
      "applicability_unknown": true
    },
    {
      "name": "lighttpd",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.76-r0"
            }
          ]
        }
      ],
      "cve_ids": [
        "CVE-2024-3094"
      ],
      "release": "3.15",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-3094",
      "fixed_version": "1.4.76-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-3094",
      "provider_updated_at": "2026-09-15T08:17:48.456797665Z"
    },
    {
      "name": "lighttpd",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.76-r0"
            }
          ]
        }
      ],
      "cve_ids": [
        "CVE-2024-3094"
      ],
      "release": "3.16",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-3094",
      "fixed_version": "1.4.76-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-3094",
      "provider_updated_at": "2026-09-15T08:17:48.456797665Z"
    },
    {
      "name": "lighttpd",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.76-r0"
            }
          ]
        }
      ],
      "cve_ids": [
        "CVE-2024-3094"
      ],
      "release": "3.17",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-3094",
      "fixed_version": "1.4.76-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-3094",
      "provider_updated_at": "2026-09-15T08:17:48.456797665Z"
    },
    {
      "name": "lighttpd",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.4.76-r0"
            }
          ]
        }
      ],
      "cve_ids": [
        "CVE-2024-3094"
      ],
      "release": "3.18",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-3094",
      "fixed_version": "1.4.76-r0",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-3094",
      "provider_updated_at": "2026-09-15T08:17:48.456797665Z"
    },
    {
      "name": "xz",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.1-r2"
            }
          ]
        }
      ],
      "cve_ids": [
        "CVE-2024-3094"
      ],
      "release": "3.20",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-3094",
      "fixed_version": "5.6.1-r2",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-3094",
      "provider_updated_at": "2026-09-15T08:17:48.456797665Z"
    },
    {
      "name": "xz",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.1-r2"
            }
          ]
        }
      ],
      "cve_ids": [
        "CVE-2024-3094"
      ],
      "release": "3.21",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-3094",
      "fixed_version": "5.6.1-r2",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-3094",
      "provider_updated_at": "2026-09-15T08:17:48.456797665Z"
    },
    {
      "name": "xz",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.1-r2"
            }
          ]
        }
      ],
      "cve_ids": [
        "CVE-2024-3094"
      ],
      "release": "3.22",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-3094",
      "fixed_version": "5.6.1-r2",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-3094",
      "provider_updated_at": "2026-09-15T08:17:48.456797665Z"
    },
    {
      "name": "xz",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.1-r2"
            }
          ]
        }
      ],
      "cve_ids": [
        "CVE-2024-3094"
      ],
      "release": "3.23",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-3094",
      "fixed_version": "5.6.1-r2",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-3094",
      "provider_updated_at": "2026-09-15T08:17:48.456797665Z"
    },
    {
      "name": "xz",
      "distro": "alpine",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.1-r2"
            }
          ]
        }
      ],
      "cve_ids": [
        "CVE-2024-3094"
      ],
      "release": "3.24",
      "versions": [],
      "ecosystem": "apk",
      "provider_url": "https://osv.dev/vulnerability/ALPINE-CVE-2024-3094",
      "fixed_version": "5.6.1-r2",
      "provider_source": "pypi",
      "provider_record_id": "ALPINE-CVE-2024-3094",
      "provider_updated_at": "2026-09-15T08:17:48.456797665Z"
    },
    {
      "name": "xz",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.2-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2024:14017-1",
      "fixed_version": "5.6.2-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2024:14017-1",
      "provider_updated_at": "2026-02-04T04:17:49.767857Z",
      "applicability_unknown": true
    }
  ]
}

Understanding this vulnerability

Reviewed by OpenFactory · Oct 29, 2026, 4:04:32 AM UTC

What was compromised

The XZ maintainer identifies the 5.6.0 and 5.6.1 release tarballs as containing the backdoor. The malicious build trigger was not in the Git repository in the same form. This is why a tarball, a Git checkout, and a distribution rebuild with the same apparent version require different provenance checks. The upstream incident page also distinguishes XZ Utils from the unaffected xz-java and xz-embedded repositories.

[XZ maintainer incident report]

Choose the distribution response for your system

Debian records the incident under xz-utils and documents its response with a 5.6.1+really5.4.5-1 package revision. That revision illustrates why sorting a package version as a plain upstream number can mislead. Check your distribution release and repository, identify the installed liblzma package and its source, and follow the distribution incident advisory. Do not substitute a fixed version reported for another distribution.

[Debian CVE-2024-3094 tracker]

Verify the replacement and retained images

XZ Utils includes the xz command-line tools and the liblzma library; checking only a tool banner can miss the library used by another program. As an operational check, verify the installed package inventory and provenance after the distribution repair, and review images or artifacts built from the affected source. Upstream published clean replacement releases after the incident, but an upgrade decision should also account for later security advisories on its current project page.

[XZ Utils project and security updates][XZ maintainer incident report]

Why some provider rows need review

The retained OSV Alpine record associates this CVE with lighttpd package versions. That association does not establish an XZ or liblzma fix. OpenFactory labels those observations for review and excludes them from the fix overview. The original provider fields remain available for inspection alongside the upstream incident description.

[Retained Alpine OSV source record][XZ maintainer incident report]

Sources and review dates

[XZ maintainer incident report]Checked Oct 29, 2026, 4:04:32 AM UTC
[XZ Utils project and security updates]Checked Oct 29, 2026, 4:04:32 AM UTC
[Debian CVE-2024-3094 tracker]Checked Oct 29, 2026, 4:04:32 AM UTC
[Retained Alpine OSV source record]Checked Oct 29, 2026, 4:04:32 AM UTC

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[liblzma5]Sconosciuto
Pacchetto sorgente: [xz-utils]
Dettagli (4)
- 5.4.1-1+deb12u1 · amd64 · bookworm
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1+deb12u1 · arm64 · bookworm
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1 · amd64 · bookworm-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1 · arm64 · bookworm-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
[liblzma-dev]Sconosciuto
Pacchetto sorgente: [xz-utils]
Dettagli (4)
- 5.4.1-1+deb12u1 · amd64 · bookworm
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1+deb12u1 · arm64 · bookworm
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1 · amd64 · bookworm-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1 · arm64 · bookworm-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
[liblzma-doc]Sconosciuto
Pacchetto sorgente: [xz-utils]
Dettagli (4)
- 5.4.1-1+deb12u1 · all · bookworm
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1+deb12u1 · all · bookworm
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1 · all · bookworm-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1 · all · bookworm-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
[xzdec]Sconosciuto
Pacchetto sorgente: [xz-utils]
Dettagli (4)
- 5.4.1-1+deb12u1 · amd64 · bookworm
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1+deb12u1 · arm64 · bookworm
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1 · amd64 · bookworm-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1 · arm64 · bookworm-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
[xz-utils]Sconosciuto
Dettagli (4)
- 5.4.1-1+deb12u1 · amd64 · bookworm
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1+deb12u1 · arm64 · bookworm
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1 · amd64 · bookworm-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.4.1-1 · arm64 · bookworm-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14

[Debian 13 (Trixie)]

[liblzma5]Sconosciuto
Pacchetto sorgente: [xz-utils]
Dettagli (3)
- 5.8.1-1+deb13u1 · amd64 · trixie
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.8.1-1+deb13u1 · arm64 · trixie
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.8.1-1+deb13u2 · amd64 · trixie-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
[liblzma-dev]Sconosciuto
Pacchetto sorgente: [xz-utils]
Dettagli (3)
- 5.8.1-1+deb13u1 · amd64 · trixie
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.8.1-1+deb13u1 · arm64 · trixie
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.8.1-1+deb13u2 · amd64 · trixie-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
[liblzma-doc]Sconosciuto
Pacchetto sorgente: [xz-utils]
Dettagli (3)
- 5.8.1-1+deb13u1 · all · trixie
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.8.1-1+deb13u1 · all · trixie
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.8.1-1+deb13u2 · all · trixie-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
[xzdec]Sconosciuto
Pacchetto sorgente: [xz-utils]
Dettagli (3)
- 5.8.1-1+deb13u1 · amd64 · trixie
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.8.1-1+deb13u1 · arm64 · trixie
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.8.1-1+deb13u2 · amd64 · trixie-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
[xz-utils]Sconosciuto
Dettagli (3)
- 5.8.1-1+deb13u1 · amd64 · trixie
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.8.1-1+deb13u1 · arm64 · trixie
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14
- 5.8.1-1+deb13u2 · amd64 · trixie-security
  Sconosciuto · Corretta: 5.6.1+really5.4.5-1
  Version impact unknown
  dsa · xz-utils · debian · bookworm; pypi · xz-utils · debian · 13; pypi · xz-utils · debian · 14

[openSUSE Leap 15.6]

[liblzma5]Sconosciuto
Pacchetto sorgente: [xz]
Dettagli (4)
- 5.4.1-150600.1.2 · aarch64 · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · ppc64le · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · s390x · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · x86_64 · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
[liblzma5-32bit]Sconosciuto
Pacchetto sorgente: [xz]
Dettagli (1)
- 5.4.1-150600.1.2 · x86_64 · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
[xz]Sconosciuto
Pacchetto sorgente: [xz]
Dettagli (4)
- 5.4.1-150600.1.2 · aarch64 · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · ppc64le · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · s390x · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · x86_64 · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
[xz-devel]Sconosciuto
Pacchetto sorgente: [xz]
Dettagli (4)
- 5.4.1-150600.1.2 · aarch64 · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · ppc64le · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · s390x · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · x86_64 · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
[xz-devel-32bit]Sconosciuto
Pacchetto sorgente: [xz]
Dettagli (1)
- 5.4.1-150600.1.2 · x86_64 · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
[xz-lang]Sconosciuto
Pacchetto sorgente: [xz]
Dettagli (1)
- 5.4.1-150600.1.2 · noarch · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
[xz-static-devel]Sconosciuto
Pacchetto sorgente: [xz]
Dettagli (4)
- 5.4.1-150600.1.2 · aarch64 · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · ppc64le · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · s390x · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.4.1-150600.1.2 · x86_64 · leap-15.6
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed

[openSUSE Leap 16.0]

[liblzma5]Sconosciuto
Pacchetto sorgente: [xz]
Dettagli (8)
- 5.8.1-160000.2.2 · aarch64 · leap-16.0
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.8.1-160000.2.2 · ppc64le · leap-16.0
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.8.1-160000.2.2 · s390x · leap-16.0
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.8.1-160000.2.2 · x86_64 · leap-16.0
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.8.1-160000.3.1 · aarch64 · leap-16.0
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.8.1-160000.3.1 · ppc64le · leap-16.0
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.8.1-160000.3.1 · s390x · leap-16.0
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.8.1-160000.3.1 · x86_64 · leap-16.0
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
[liblzma5-32bit]Sconosciuto
Pacchetto sorgente: [xz]
Dettagli (1)
- 5.8.1-160000.3.1 · x86_64 · leap-16.0
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
[liblzma5-x86-64-v3]Sconosciuto
Pacchetto sorgente: [xz]
Dettagli (2)
- 5.8.1-160000.2.2 · x86_64 · leap-16.0
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed
- 5.8.1-160000.3.1 · x86_64 · leap-16.0
  Sconosciuto · Corretta: 5.6.2-1.1
  Version impact unknown
  pypi · xz · opensuse · tumbleweed

Altri risultati

Osservato: Oct 29, 2026, 4:20:00 AM UTC

Riferimenti

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]