Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Red Hat Enterprise Linux xz tool may allow malicious code execution
published 1 year ago
Summary
The xz compression program included with Red Hat Enterprise Linux can be tricked into running harmful code. This could let an attacker take control of the affected system. Install the latest Red Hat security update for xz as soon as possible to protect your environment.
What to do
- Update redhat xz-debuginfo to version 1:5.6.2-4.el10_0.
- Update redhat xz-debugsource to version 1:5.6.2-4.el10_0.
- Update redhat xz-devel to version 1:5.6.2-4.el10_0.
- Update redhat xz-libs-debuginfo to version 1:5.6.2-4.el10_0.
- Update redhat xz-lzma-compat to version 1:5.6.2-4.el10_0.
- Update redhat xz-lzma-compat-debuginfo to version 1:5.6.2-4.el10_0.
- Update redhat xz to version 1:5.6.2-4.el10_0.
- Update redhat xz-libs to version 1:5.6.2-4.el10_0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:enterprise_linux:10.0 | redhat | xz-debuginfo |
< 1:5.6.2-4.el10_0 Fix: upgrade to 1:5.6.2-4.el10_0
|
| Red Hat:enterprise_linux:10.0 | redhat | xz-debugsource |
< 1:5.6.2-4.el10_0 Fix: upgrade to 1:5.6.2-4.el10_0
|
| Red Hat:enterprise_linux:10.0 | redhat | xz-devel |
< 1:5.6.2-4.el10_0 Fix: upgrade to 1:5.6.2-4.el10_0
|
| Red Hat:enterprise_linux:10.0 | redhat | xz-libs-debuginfo |
< 1:5.6.2-4.el10_0 Fix: upgrade to 1:5.6.2-4.el10_0
|
| Red Hat:enterprise_linux:10.0 | redhat | xz-lzma-compat |
< 1:5.6.2-4.el10_0 Fix: upgrade to 1:5.6.2-4.el10_0
|
| Red Hat:enterprise_linux:10.0 | redhat | xz-lzma-compat-debuginfo |
< 1:5.6.2-4.el10_0 Fix: upgrade to 1:5.6.2-4.el10_0
|
| Red Hat:enterprise_linux:10.0 | redhat | xz |
< 1:5.6.2-4.el10_0 Fix: upgrade to 1:5.6.2-4.el10_0
|
| Red Hat:enterprise_linux:10.0 | redhat | xz-libs |
< 1:5.6.2-4.el10_0 Fix: upgrade to 1:5.6.2-4.el10_0
|
Original advisory text
Red Hat Security Advisory: xz security update
References
- https://access.redhat.com/errata/RHSA-2025:7524 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2357249 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7524.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2025-31115 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2025-31115 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-31115 Vendor Advisory
- https://github.com/tukaani-project/xz/commit/d5a2ffe41bb77b918a8c96084885d4dbe4b... Third Party Advisory
- https://github.com/tukaani-project/xz/security/advisories/GHSA-6cc8-p5mm-29w2 Third Party Advisory
- https://tukaani.org/xz/xz-cve-2025-31115.patch Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published14 May 2025
Updated25 Aug 2026
First seen25 Aug 2026
Sources
RHSA-2025:7524 · OSV
Track software like this
Free during beta