XZ Utils
Security incidents tagged XZ Utils. Newest first.
0 XZ Utils incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 0
- Patched
- 1
- Days without an incident
- 937
- Longest quiet run: 876 days (May 30–Oct 22)
Show 1 older incident1 older incident
March 2024 1
- CriticalPatched
xz-utils backdoor (CVE-2024-3094)
A maintainer persona, 'Jia Tan', slipped a backdoor into the release tarballs of XZ Utils 5.6.0 and 5.6.1. Through liblzma it targeted OpenSSH's sshd on distributions that link sshd against libsystemd, so a key holder could get unauthenticated remote code execution. Andres Freund spotted it after noticing SSH logins using a lot of CPU on Debian sid. It reached only bleeding-edge distributions such as Fedora 41/Rawhide and Debian unstable before it was caught.
XZ Utils (liblzma)Closed May 29, 2024
