An issue discovered in XZ 5.2.5 allows attackers to cause a denial of service via decompression of a crafted file. NOTE: the vendor disputes the claims of endless output and denial of service because decompression of the 17,486 bytes always results in 114,881,179 bytes, which is often a reasonable size increase.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Xz | Tukaani | 5.2.5 (including) | 5.2.5 (including) |
| Xz-utils | Ubuntu | bionic | * |
| Xz-utils | Ubuntu | lunar | * |
| Xz-utils | Ubuntu | mantic | * |
| Xz-utils | Ubuntu | trusty | * |
| Xz-utils | Ubuntu | xenial | * |