QSN-8945-1: XZ Utils vulnerability
2026-10-20

Summary:
XZ Utils could be made to crash or run programs if it processed
specially crafted compressed files under certain conditions.

Details:
It was discovered that XZ Utils incorrectly handled certain memory
allocation failures when reinitializing decoders for specific compressed
file formats. An attacker could possibly use this issue to trigger an
invalid memory write, resulting in a denial of service or arbitrary code
execution.

Affected QuantaStor releases:
  6.9.1.001 jammy: liblzma5 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.9.1.001 jammy: xz-utils 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.9.0.464 jammy: liblzma5 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.9.0.464 jammy: xz-utils 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.6.015 jammy: liblzma5 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.6.015 jammy: xz-utils 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.5.018 jammy: liblzma5 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.5.018 jammy: xz-utils 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.4.038 jammy: liblzma5 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.4.038 jammy: xz-utils 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.3.018 jammy: liblzma5 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.3.018 jammy: xz-utils 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.2.002 jammy: liblzma5 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.2.002 jammy: xz-utils 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.1.007 jammy: liblzma5 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.1.007 jammy: xz-utils 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.0.205 jammy: liblzma5 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)
  6.8.0.205 jammy: xz-utils 5.2.5-2ubuntu1 (fixed in 5.2.5-2ubuntu1.2)

CVEs: 

References:
  https://ubuntu.com/security/notices/USN-8945-1
  https://bugs.launchpad.net/bugs/2170056