Quantcast
Channel: CVE-2024-3094: Malicious code in xz 5.6.0 and 5.6.1 tarballs
Viewing all articles
Browse latest Browse all 26

CVE-2024-3094: Malicious code in xz 5.6.0 and 5.6.1 tarballs

$
0
0

I’m not sure I understand. xz does link against (it’s own) liblzma:

$ lddtree `which xz`
/run/current-system/sw/bin/xz (interpreter => /nix/store/1rm6sr6ixxzipv5358x0cmaw8rs84g2j-glibc-2.38-44/lib/ld-linux-x86-64.so.2)
    liblzma.so.5 => /nix/store/yyqzw7xvsrn3h2zrvincbs1b291yzx8c-xz-5.6.1/lib/liblzma.so.5
    libpthread.so.0 => /nix/store/1rm6sr6ixxzipv5358x0cmaw8rs84g2j-glibc-2.38-44/lib/libpthread.so.0
    libc.so.6 => /nix/store/1rm6sr6ixxzipv5358x0cmaw8rs84g2j-glibc-2.38-44/lib/libc.so.6

If we are to fix liblzma we should relink xz as well.

Read full topic


Viewing all articles
Browse latest Browse all 26

Trending Articles