-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Mon, 20 Jul 2026 12:54:35 -0700 Source: xz-utils Architecture: source Version: 5.2.5-2.1~deb11u2 Distribution: bullseye-security Urgency: high Maintainer: Jonathan Nieder <jrnieder@gmail.com> Changed-By: Chris Lamb <lamby@debian.org> Closes: 1132497 Changes: xz-utils (5.2.5-2.1~deb11u2) bullseye-security; urgency=high . * Non-maintainer upload by the Debian LTS team. * CVE-2026-34743: Fix a potential buffer overflow issue. If the lzma_index_decoder function was used to decode an index that contained no records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append would allocate too little memory and a buffer overflow would therefore occur. (Closes: #1132497) Checksums-Sha1: 0aa9f339dfee69c6c0733870ddd6f574b8ffacce 2279 xz-utils_5.2.5-2.1~deb11u2.dsc 0d3502d92866ccbf7dac8a216e56eb61dcf073fc 1800720 xz-utils_5.2.5.orig.tar.gz 2a5c58ce9af95274bbc054ff6940dd633d39fee3 35928 xz-utils_5.2.5-2.1~deb11u2.debian.tar.xz 47faf49f20426d029e8d45d3ae1da251e8ffa23b 5785 xz-utils_5.2.5-2.1~deb11u2_source.buildinfo Checksums-Sha256: 53e30ae028bdf6966db2fafd4397ee0cfaf3ee2c3f3116ae9a69e1aaba5f5301 2279 xz-utils_5.2.5-2.1~deb11u2.dsc 2e0a85d107b83832d370470b0ac6fc246734e78aed0711af58c981c0f39370df 1800720 xz-utils_5.2.5.orig.tar.gz 79a11483d477231a6d7f35655aebd95fe06beece4be76df47792b309c214fab2 35928 xz-utils_5.2.5-2.1~deb11u2.debian.tar.xz f7071fe40f42c51173e6a3da2784af0d2ffa332933ed35b296ef8119193e11c2 5785 xz-utils_5.2.5-2.1~deb11u2_source.buildinfo Files: 7181cb5b2ac781796e7b946a6cc51673 2279 utils optional xz-utils_5.2.5-2.1~deb11u2.dsc 1850089ca0835814494d22b083a86101 1800720 utils optional xz-utils_5.2.5.orig.tar.gz 66b8e48608b416238b9d106c2314ec55 35928 utils optional xz-utils_5.2.5-2.1~deb11u2.debian.tar.xz 550347c345f5e12fd6817dbaf7b7882e 5785 utils optional xz-utils_5.2.5-2.1~deb11u2_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmpfzEkACgkQHpU+J9Qx Hli50Q//RLIViPivNWOQehHSVhziCt9DX8e5ndN3SBS2WwFXq6Wn1mUYX+IbH/ld oJaARhFhYS8yBxJqGTyDPydDCAjG1cBEI0aI17+t5dcc+JghEySm8D2tzhyMcx/F Y9256BMAVfQUC5eMyR2NNuoYUhKNkkcEbvZG/z6xaKIV928WMnlan7dQrRVPKGuh 06t3g316Aj64I3imlH1UBCsAltnpLisfmBukEe9PaNhxFMrvLYCPIJ/2mSPZBYGZ p1ODs6l1iafpbNHhQhfb5EnUmYWlYPOngZ2+sKKkhHkSUOrt8r8HODghigpAp4C1 RFBqx98hHh8zpBEmll1Aa73g2qzgYx6TXFuP+V+mLcr0G7jTVmHozMjGHBls7OFl 7di7dBSAvf5YbCqlwt7QRpdtLgzn9fU9MyeS9P+CdZ/XUsslHyl5Fxi4PtTOVh/E yqVNyv1q9Ke4ZzoFB0yhNwASCwQsBgDsni+K8CbnbHH8lK1RSWR2uJZV4zHIc0ob DJ2zQ6JMbQIy8xxMS5y1WtNwkU4pV4FogqLuo7BSMVRE9f9dmnl1yPrNuAL3rMBY 2WbZT7V64TWXJT6oexbMyCcJWqfdOHLYR33DR1zwoOlqrC4KaVIsORNARt+qnHAK Asol/qCJT7MlVXZRASxZ4WsMtm5o04aJC94tFCXqFKNjIyVasEI= =eqU4 -----END PGP SIGNATURE-----
