Tukaani vulnerabilities
Published CVEs affecting Tukaani products: 2 record(s), with severity, exploitation and fixes.
CVE-2026-34743
Medium · 5.3
CWE-122 Apr 2, 2026
XZ Utils: Buffer overflow in lzma_index_append()
XZ Utils provide a general-purpose data-compression library plus command-line tools. Prior to version 5.8.3, if lzma_index_decoder() was used to decode an Index that contained no Records, the resulting lzma_index was left in a state where where a subsequent lzma_index_append() would allocate too little memory, and a buffer overflow would occur. This issue has been patched in version 5.8.3.
CVE-2022-1271
High · 8.8
CWE-20 Aug 31, 2022
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is...
An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system.