Advisories » MGASA-2026-0396

Updated xz packages fix security vulnerabilities

Publication date: 12 Sep 2026
Modification date: 12 Sep 2026
Type: security
Affected Mageia releases : 10 , 9

Description

XZ Utils: Invalid write if a decoder is reinitialized after allocation
failure
                

References

• https://bugs.mageia.org/show_bug.cgi?id=36293
• https://www.openwall.com/lists/oss-security/2026/09/09/5
• https://tukaani.org/xz/invalid-write-after-reinit.html
• https://github.com/tukaani-project/xz/security/advisories/GHSA-5qpq-xqfv-j9pg

SRPMS

10/core

• xz-5.8.4-1.mga10

9/core

• xz-5.4.7-0.git20260909.1.mga9