#1140802 trixie-pu: package xz-utils 5.8.3-0+deb13u1

#1140802#5
Date:
2026-06-26 17:13:22 UTC
From:
To:
To fix CVE-2026-34743 I have prepared an update of xz-utils, pending review
at
https://salsa.debian.org/debian/xz-utils/-/merge_requests/6

I will post the final debdiff here once the review is complete and the
final version is known.

#1140802#12
Date:
2026-06-27 11:00:04 UTC
From:
To:
Changelog:

xz-utils (5.8.3-0+deb13u1) trixie; urgency=medium

  * Import 5.8.3
    - Includes security fix for CVE-2026-34743, for which upstream states it’s
      likely that this bug cannot be triggered in any real-world application,
      see https://tukaani.org/xz/index-append-overflow.html (Closes: #1132497)
    - Soname updated from liblzma.so.5.8.1 -> liblzma.so.5.8.3 as in all new
      versions, but ABI remains compatible with the 5.8 series
    - New man pages in Arabic and Swedish
    - Documentation of liblzma had several JS scripts and images removed, and
      images replaced with new versions
  * Add myself as uploader and prepare gbp.conf and salsa-ci.yml for easier
    maintenance of this package in Trixie (and later potentially in LTS)


Debdiff attached. Produced with:

apt source xz-utils/trixie
debdiff xz-utils_5.8.1-1.dsc xz-utils_5.8.3-0+deb13u1.dsc >
xz-utils_5.8.1-1-5.8.3-0+deb13u1.debdiff
xz -9 xz-utils_5.8.1-1-5.8.3-0+deb13u1.debdiff


diffstat xz-utils_5.8.1-1-5.8.3-0+deb13u1.debdiff
 /tmp/LkSyxnJeYx/xz-utils-5.8.3/po/es.gmo                          |binary
 xz-utils-5.8.3/CMakeLists.txt                                     |  143 +++-
 xz-utils-5.8.3/COPYING.GPLv2                                      |    9
 xz-utils-5.8.3/COPYING.LGPLv2.1                                   |    9
 xz-utils-5.8.3/ChangeLog                                          |
2063 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 xz-utils-5.8.3/Makefile.in                                        |   18
 xz-utils-5.8.3/NEWS                                               |  126 ++++
 xz-utils-5.8.3/THANKS                                             |
407 +++++++------
 xz-utils-5.8.3/aclocal.m4                                         |   74 +-
 xz-utils-5.8.3/build-aux/compile                                  |   35 -
 xz-utils-5.8.3/build-aux/config.guess                             |   17
 xz-utils-5.8.3/build-aux/config.sub                               |   28
 xz-utils-5.8.3/build-aux/depcomp                                  |    8
 xz-utils-5.8.3/build-aux/install-sh                               |    6
 xz-utils-5.8.3/build-aux/ltmain.sh                                |
207 +++++--
 xz-utils-5.8.3/build-aux/manconv.sh                               |    8
 xz-utils-5.8.3/build-aux/missing                                  |    8
 xz-utils-5.8.3/build-aux/test-driver                              |    8
 xz-utils-5.8.3/cmake/tuklib_cpucores.cmake                        |    4
 xz-utils-5.8.3/cmake/tuklib_integer.cmake                         |
245 ++++++--
 xz-utils-5.8.3/cmake/tuklib_physmem.cmake                         |    2
 xz-utils-5.8.3/config.h.in                                        |   10
 xz-utils-5.8.3/configure                                          |
3998 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++----------------------------------------------------------
 xz-utils-5.8.3/configure.ac                                       |   37 +
 xz-utils-5.8.3/debian/changelog                                   |   16
 xz-utils-5.8.3/debian/control                                     |    2
 xz-utils-5.8.3/debian/gbp.conf                                    |   49 +
 xz-utils-5.8.3/debian/salsa-ci.yml                                |   22
 xz-utils-5.8.3/debug/Makefile.in                                  |    6
 xz-utils-5.8.3/doc/man/txt/lzmainfo.txt                           |   41 -
 xz-utils-5.8.3/doc/man/txt/xz.txt                                 |
3133 ++++++++++++++++++++++++++++++++++++++++++++++++++++-------------------------------------------------------
 xz-utils-5.8.3/doc/man/txt/xzdec.txt                              |  110 +--
 xz-utils-5.8.3/doc/man/txt/xzdiff.txt                             |   54 -
 xz-utils-5.8.3/doc/man/txt/xzgrep.txt                             |   81 +-
 xz-utils-5.8.3/doc/man/txt/xzless.txt                             |   48 -
 xz-utils-5.8.3/doc/man/txt/xzmore.txt                             |   37 -
 xz-utils-5.8.3/doxygen/Doxyfile                                   |    8
 xz-utils-5.8.3/lib/Makefile.in                                    |    6
 xz-utils-5.8.3/m4/libtool.m4                                      |
640 +++++++++++++++++----
 xz-utils-5.8.3/m4/ltoptions.m4                                    |   56 +
 xz-utils-5.8.3/m4/ltsugar.m4                                      |    2
 xz-utils-5.8.3/m4/ltversion.m4                                    |   12
 xz-utils-5.8.3/m4/lt~obsolete.m4                                  |    2
 xz-utils-5.8.3/m4/tuklib_integer.m4                               |  146 ++++-
 xz-utils-5.8.3/po/Makevars                                        |    2
 xz-utils-5.8.3/po/POTFILES.in                                     |    1
 xz-utils-5.8.3/po/ca.po                                           |  148 ++---
 xz-utils-5.8.3/po/cs.po                                           |  148 ++---
 xz-utils-5.8.3/po/da.po                                           |  148 ++---
 xz-utils-5.8.3/po/de.po                                           |  148 ++---
 xz-utils-5.8.3/po/eo.po                                           |  148 ++---
 xz-utils-5.8.3/po/es.po                                           |  158 ++---
 xz-utils-5.8.3/po/fi.po                                           |  148 ++---
 xz-utils-5.8.3/po/fr.po                                           |  148 ++---
 xz-utils-5.8.3/po/hr.po                                           |  148 ++---
 xz-utils-5.8.3/po/hu.po                                           |  148 ++---
 xz-utils-5.8.3/po/it.po                                           |  148 ++---
 xz-utils-5.8.3/po/ka.po                                           |  148 ++---
 xz-utils-5.8.3/po/ko.po                                           |  148 ++---
 xz-utils-5.8.3/po/nl.po                                           |  148 ++---
 xz-utils-5.8.3/po/pl.po                                           |  148 ++---
 xz-utils-5.8.3/po/pt.po                                           |  148 ++---
 xz-utils-5.8.3/po/pt_BR.po                                        |  148 ++---
 xz-utils-5.8.3/po/ro.po                                           |  148 ++---
 xz-utils-5.8.3/po/sr.po                                           |  148 ++---
 xz-utils-5.8.3/po/sv.po                                           |  148 ++---
 xz-utils-5.8.3/po/tr.po                                           |  148 ++---
 xz-utils-5.8.3/po/uk.po                                           |  148 ++---
 xz-utils-5.8.3/po/vi.po                                           |  148 ++---
 xz-utils-5.8.3/po/xz.pot                                          |  150 ++---
 xz-utils-5.8.3/po/zh_CN.po                                        |  148 ++---
 xz-utils-5.8.3/po/zh_TW.po                                        |  148 ++---
 xz-utils-5.8.3/po4a/ar.po                                         |
3905 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 xz-utils-5.8.3/po4a/de.po                                         |   14
 xz-utils-5.8.3/po4a/fr.po                                         |    9
 xz-utils-5.8.3/po4a/it.po                                         |   15
 xz-utils-5.8.3/po4a/ko.po                                         |   17
 xz-utils-5.8.3/po4a/man/ar/lzmainfo.1                             |   41 +
 xz-utils-5.8.3/po4a/man/ar/xz.1                                   |
1791 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 xz-utils-5.8.3/po4a/man/ar/xzdec.1                                |   77 ++
 xz-utils-5.8.3/po4a/man/ar/xzdiff.1                               |   52 +
 xz-utils-5.8.3/po4a/man/ar/xzgrep.1                               |   89 +++
 xz-utils-5.8.3/po4a/man/ar/xzless.1                               |   45 +
 xz-utils-5.8.3/po4a/man/ar/xzmore.1                               |   47 +
 xz-utils-5.8.3/po4a/man/de/xz.1                                   |   18
 xz-utils-5.8.3/po4a/man/fr/xz.1                                   |   17
 xz-utils-5.8.3/po4a/man/it/xz.1                                   |   19
 xz-utils-5.8.3/po4a/man/ko/xz.1                                   |   10
 xz-utils-5.8.3/po4a/man/pt_BR/xz.1                                |   17
 xz-utils-5.8.3/po4a/man/ro/lzmainfo.1                             |    1
 xz-utils-5.8.3/po4a/man/ro/xz.1                                   |   21
 xz-utils-5.8.3/po4a/man/ro/xzdec.1                                |    1
 xz-utils-5.8.3/po4a/man/ro/xzdiff.1                               |    1
 xz-utils-5.8.3/po4a/man/ro/xzgrep.1                               |    1
 xz-utils-5.8.3/po4a/man/ro/xzless.1                               |    1
 xz-utils-5.8.3/po4a/man/ro/xzmore.1                               |    1
 xz-utils-5.8.3/po4a/man/sr/xz.1                                   |   54 -
 xz-utils-5.8.3/po4a/man/sr/xzdiff.1                               |   11
 xz-utils-5.8.3/po4a/man/sr/xzgrep.1                               |   15
 xz-utils-5.8.3/po4a/man/sr/xzless.1                               |    8
 xz-utils-5.8.3/po4a/man/sr/xzmore.1                               |    8
 xz-utils-5.8.3/po4a/man/sv/lzmainfo.1                             |   42 +
 xz-utils-5.8.3/po4a/man/sv/xz.1                                   |
1954 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 xz-utils-5.8.3/po4a/man/sv/xzdec.1                                |   87 ++
 xz-utils-5.8.3/po4a/man/sv/xzdiff.1                               |   54 +
 xz-utils-5.8.3/po4a/man/sv/xzgrep.1                               |   92 +++
 xz-utils-5.8.3/po4a/man/sv/xzless.1                               |   47 +
 xz-utils-5.8.3/po4a/man/sv/xzmore.1                               |   48 +
 xz-utils-5.8.3/po4a/man/uk/xz.1                                   |   18
 xz-utils-5.8.3/po4a/po4a.conf                                     |    2
 xz-utils-5.8.3/po4a/pt_BR.po                                      |   14
 xz-utils-5.8.3/po4a/ro.po                                         |   18
 xz-utils-5.8.3/po4a/sr.po                                         |   83 --
 xz-utils-5.8.3/po4a/sv.po                                         |
3904 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 xz-utils-5.8.3/po4a/uk.po                                         |   15
 xz-utils-5.8.3/po4a/update-po                                     |    2
 xz-utils-5.8.3/po4a/xz-man.pot                                    |   11
 xz-utils-5.8.3/src/Makefile.in                                    |    6
 xz-utils-5.8.3/src/common/my_landlock.h                           |   45 +
 xz-utils-5.8.3/src/common/mythread.h                              |    3
 xz-utils-5.8.3/src/common/tuklib_gettext.h                        |    4
 xz-utils-5.8.3/src/common/tuklib_integer.h                        |   19
 xz-utils-5.8.3/src/common/tuklib_mbstr_wrap.h                     |    4
 xz-utils-5.8.3/src/common/tuklib_open_stdxxx.h                    |    2
 xz-utils-5.8.3/src/common/w32_application.manifest.comments.txt   |    2
 xz-utils-5.8.3/src/liblzma/Makefile.am                            |    4
 xz-utils-5.8.3/src/liblzma/Makefile.in                            |   10
 xz-utils-5.8.3/src/liblzma/api/Makefile.in                        |    6
 xz-utils-5.8.3/src/liblzma/api/lzma/base.h                        |    6
 xz-utils-5.8.3/src/liblzma/api/lzma/container.h                   |   38 -
 xz-utils-5.8.3/src/liblzma/api/lzma/version.h                     |    2
 xz-utils-5.8.3/src/liblzma/check/crc32_arm64.h                    |    5
 xz-utils-5.8.3/src/liblzma/check/crc32_fast.c                     |    4
 xz-utils-5.8.3/src/liblzma/check/crc64_fast.c                     |   10
 xz-utils-5.8.3/src/liblzma/check/crc_common.h                     |   19
 xz-utils-5.8.3/src/liblzma/check/crc_x86_clmul.h                  |    2
 xz-utils-5.8.3/src/liblzma/common/alone_decoder.c                 |    6
 xz-utils-5.8.3/src/liblzma/common/filter_common.c                 |    4
 xz-utils-5.8.3/src/liblzma/common/index.c                         |   21
 xz-utils-5.8.3/src/liblzma/common/lzip_decoder.c                  |    3
 xz-utils-5.8.3/src/liblzma/common/outqueue.h                      |    1
 xz-utils-5.8.3/src/liblzma/common/stream_decoder_mt.c             |   79 +-
 xz-utils-5.8.3/src/liblzma/common/vli_decoder.c                   |    2
 xz-utils-5.8.3/src/liblzma/liblzma.pc.in                          |    1
 xz-utils-5.8.3/src/liblzma/lzma/lzma_common.h                     |    4
 xz-utils-5.8.3/src/liblzma/lzma/lzma_decoder.h                    |   11
 xz-utils-5.8.3/src/liblzma/rangecoder/range_decoder.h             |    7
 xz-utils-5.8.3/src/liblzma/validate_map.sh                        |    4
 xz-utils-5.8.3/src/lzmainfo/Makefile.in                           |    6
 xz-utils-5.8.3/src/scripts/Makefile.in                            |    6
 xz-utils-5.8.3/src/scripts/xzdiff.in                              |    6
 xz-utils-5.8.3/src/scripts/xzgrep.in                              |    2
 xz-utils-5.8.3/src/scripts/xzless.in                              |    2
 xz-utils-5.8.3/src/scripts/xzmore.in                              |    4
 xz-utils-5.8.3/src/xz/Makefile.in                                 |    6
 xz-utils-5.8.3/src/xz/args.c                                      |    1
 xz-utils-5.8.3/src/xz/file_io.c                                   |    4
 xz-utils-5.8.3/src/xz/hardware.c                                  |   72 ++
 xz-utils-5.8.3/src/xz/list.c                                      |    2
 xz-utils-5.8.3/src/xz/main.c                                      |   10
 xz-utils-5.8.3/src/xz/message.h                                   |    4
 xz-utils-5.8.3/src/xz/sandbox.c                                   |   26
 xz-utils-5.8.3/src/xz/signals.c                                   |   17
 xz-utils-5.8.3/src/xz/util.c                                      |    4
 xz-utils-5.8.3/src/xz/xz.1                                        |    9
 xz-utils-5.8.3/src/xzdec/Makefile.in                              |    6
 xz-utils-5.8.3/src/xzdec/xzdec.c                                  |    2
 xz-utils-5.8.3/tests/Makefile.in                                  |    8
 xz-utils-5.8.3/tests/ossfuzz/config/fuzz_decode_stream_mt.options |    4
 xz-utils-5.8.3/tests/test_bcj_exact_size.c                        |    2
 xz-utils-5.8.3/tests/test_block_header.c                          |    2
 xz-utils-5.8.3/tests/test_index.c                                 |   35 +
 xz-utils-5.8.3/tests/test_suffix.sh                               |    4
 xz-utils-5.8.3/windows/build.bash                                 |    4
 174 files changed, 22645 insertions(+), 6438 deletions(-)