Hi

As per https://tukaani.org/xz/invalid-write-after-reinit.html and https://github.com/tukaani-project/xz/security/advisories/GHSA-5qpq-xqfv-j9pg


| In XZ Utils 5.8.3 and older, an invalid memory write can occur in
| decoders that are initialized using the following functions:
|
|     lzma_alone_decoder (decodes .lzma files)
|
|     lzma_lzip_decoder (decodes .lz files)
|
|     lzma_auto_decoder (when decoding .lzma or .lz files)
|
|     lzma_microlzma_decoder (decodes MicroLZMA format)
|
| Required steps:
|
|     A lzma_stream is initialized using one of the above functions.
|
|     A file is decoded at least partially.
|
|     The same lzma_stream is reinitialized using the same function.
|
|     Another file is decoded but memory allocation fails with
|     LZMA_MEM_ERROR. (LZMA_MEMLIMIT_ERROR doesn’t cause this.)
|
|     The same lzma_stream is reinitialized again using the same function.
|
|     A file is decoded. It must specify the same dictionary size as the
|     file in step 2.
|
| Decoders for the .xz format and raw streams aren’t affected.
|
| The issue has been fixed in XZ Utils 5.8.4 and in the Git repository
| branch v5.8. The fix is also in the Git repository branches v5.6,
| v5.4, and v5.2, but no new releases will be made from these old
| branches.
|
| The bug was reported and discovered by Cantina using their AppSec
| agent, Apex.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
xz-utils, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1147318@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Otto Kekäläinen <otto@debian.org> (supplier of updated xz-utils package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Wed, 09 Sep 2026 18:18:18 +0000
Source: xz-utils
Architecture: source
Version: 5.8.4-1
Distribution: unstable
Urgency: medium
Maintainer: Sebastian Andrzej Siewior <sebastian@breakpoint.cc>
Changed-By: Otto Kekäläinen <otto@debian.org>
Closes: 1147318
Changes:
 xz-utils (5.8.4-1) unstable; urgency=medium
 .
   * Import 5.8.4
     - See notes https://github.com/tukaani-project/xz/releases/tag/v5.8.4
     - Includes security fix for GHSA-5qpq-xqfv-j9pg (Closes: #1147318)
   * Drop man page syntax patch now mostly addressed upstream
   * Backport upstream commit to fix test_files.sh failure with --disable-xz
   * Bump Debhelper version from 13 to 14
   * Bump Debian Policy version to 4.7.4
Checksums-Sha1:
 cacbf313039bf4ed544267ad6a41553f554a3afb 2476 xz-utils_5.8.4-1.dsc
 b1345221051ef5ac65297926418b56d2b941fe64 1567192 xz-utils_5.8.4.orig.tar.xz
 7c63f706ba59085b6f16d3ea3945c5c00ddeac0d 27120 xz-utils_5.8.4-1.debian.tar.xz
 b5738c52f710faf6c0f844c95b190e42c72ad164 5454 xz-utils_5.8.4-1_source.buildinfo
Checksums-Sha256:
 5901f80e56358c0c1418513091b15cc5de0a9492a363d9e42108dfd77f38f07f 2476 xz-utils_5.8.4-1.dsc
 4ce24038fd4221e0d13bc1a2de7a4db56e90b92b3bf75321f6c14be73f65de4b 1567192 xz-utils_5.8.4.orig.tar.xz
 79d5dca2beef9ede917a41fee584edae9d2ffad004f73c71d51b1548b1af9bbd 27120 xz-utils_5.8.4-1.debian.tar.xz
 f4acade1ea49a69a4345eb76603118d50b398ebc4864b2b9e0207eabc07d448c 5454 xz-utils_5.8.4-1_source.buildinfo
Files:
 9a80dad783e61ad1962d028b58016ddb 2476 utils optional xz-utils_5.8.4-1.dsc
 8b2f092ad33e560bc04ffdbe3101daa7 1567192 utils optional xz-utils_5.8.4.orig.tar.xz
 095d0442ebd0587ee9ded8680501e4f9 27120 utils optional xz-utils_5.8.4-1.debian.tar.xz
 1c6e87139cf8ba53f02276f25fbfc480 5454 utils optional xz-utils_5.8.4-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEmbRSsR88dMO0U+RvvthEn87o2ogFAmqlJSMACgkQvthEn87o
2ohfhw//TlehHAfesKQVs1wbMqKeKOa71RZugDEWB+10CYRg5UpUapmW5t3+PzmZ
GM2HleE0KYbtFUI/O10Iwhy6K8+sqN1yIecrQ7bA3fSQOIDgo+3ZxdHczG8mqnK4
Ah6cE30eAcxg019Nuefv2aAKO1CwyACmWQzjdZUhNg63MD4Heb8fQ+6dx/LrvpCW
Od1EYBViKXBwpMxhuRLePZim91Y2AcWAwTTX0BE0SiR28QUfMgzT9i9J9W2tLY48
7LI8/O1cy3xVYWEYPSAQFcyW1MzdnchsJOeCcGjX0WgTL44be3wWOlIwgrtYA4m/
9zgPw80b2lckHBfNe4l9IvGA6gze1Ix4rCDuXY2gbuS83vmF+rTvT0bSN4YTMCgE
EdOSrR9ojeSzIsuuPxEI4TSGQX/pnIwmT0qbXkODOqg1ZMHa9AwkdD65CibIEfQZ
KyeBL+CmQy0SwgfTqIq7IBKRLgb8JBt4feywhOj0B3/qiiW8g3nHs7cEhhiSsl9T
6UmpZsF9e8uaDFzLL1xXBAizNt0dyEaPpBQ5ioBXprvewMBgqJyBWMqdxQMLaDBs
WrI7IxHgQwxecaK5WDk+I5X/ifbsONL3zrkRHH2Dx2pXXdXP3RdNMUOPz5UtwwjB
TGdzJ5C0F3ebOjUIB2wL0xAO/UsmWlpribRh/jx4W/O49qOw8LI=
=TrkN
-----END PGP SIGNATURE-----