CVE-2024-3094
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2024
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Xz: malicious code in distributed source
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
xz
- Vendor
- Unknown
- Product
- Unknown
- Platforms
- Unknown
- Default status
unaffected- Package
- xz
- Package collection
- https://github.com/tukaani-project/xz
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 5.6.0 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 5.6.1 | affected | Unavailable | Unavailable | Unavailable | None listed |
Red Hat Enterprise Linux 10
- Vendor
- Red Hat
- Product
- Red Hat Enterprise Linux 10
- Platforms
- Unknown
- Default status
unaffected- Package
- xz
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Enterprise Linux 6
- Vendor
- Red Hat
- Product
- Red Hat Enterprise Linux 6
- Platforms
- Unknown
- Default status
unaffected- Package
- xz
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Enterprise Linux 7
- Vendor
- Red Hat
- Product
- Red Hat Enterprise Linux 7
- Platforms
- Unknown
- Default status
unaffected- Package
- xz
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Enterprise Linux 8
- Vendor
- Red Hat
- Product
- Red Hat Enterprise Linux 8
- Platforms
- Unknown
- Default status
unaffected- Package
- xz
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat Enterprise Linux 9
- Vendor
- Red Hat
- Product
- Red Hat Enterprise Linux 9
- Platforms
- Unknown
- Default status
unaffected- Package
- xz
- Package collection
- https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.
Red Hat JBoss Enterprise Application Platform 8
- Vendor
- Red Hat
- Product
- Red Hat JBoss Enterprise Application Platform 8
- Platforms
- Unknown
- Default status
unaffected- Package
- xz
- Package collection
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html
No explicit version tuples; consult this entry's default status.