The release of XZ Utils 5.8.1 has been published, which includes the liblzma library and utilities for working with compressed data in the '.xz' format. XZ Utils 5.8.1 is the first significant release following the incident involving a backdoor discovered for sshd access. Last week, a tag for 5.8.0 was created in Git, but the release was not officially announced due to performance and compatibility issues with older versions of GNU make that were identified after the tag's publication. <\/p>\n
In the XZ Utils 5.8.1 update, a vulnerability (CVE-2025-31115) has been fixed, which could cause a crash when attempting to unpack specially crafted archives. This vulnerability is due to accessing an already freed area of memory (use after free). An attacker could exploit this to write their value to an address calculated as 'null pointer + offset'. The issue is considered an unintentional error, as the change that caused it was introduced into the code long before developer Jia Tan joined the project, whose activities led to the backdoor's implementation. <\/p>\n
The issue manifests starting with the release of XZ Utils 5.3.3alpha when decoding in multithreaded mode (single-threaded decoders are not affected). In addition to the standard utilities from the xz package, the vulnerability also appears in third-party programs using the lzma_stream_decoder_mt function from the liblzma library. The vulnerability has been fixed in the XZ Utils 5.8.1 release and also backported to stable branches 5.4 and 5.6. Updates in distributions can be tracked on the following pages: Debian, Ubuntu, RHEL, SUSE\/openSUSE, Fedora, Arch, FreeBSD. As a workaround for protection, you can disable decoding files in multithreaded mode by using the options '--decompress --threads=1' when running xz or by using the xzdec utility. <\/p>\n
Key functional changes in the XZ Utils 5.8 branch include: <\/p>\n
\n
In the LZMA\/LZMA2 decoder, the ability to use SSE2 instructions instead of the memcpy() function on 32- and 64-bit x86 systems has been added. This change allows for a reduction in decoding time of up to 5% when built with Glibc and up to 15% when built with musl while unpacking files with very high compression levels.\n
In liblzma, the encoding speed has been increased on 64-bit PowerPC and RISC-V systems.\n
A low-level API for BCJ filters (Branch\/Call\/Jump) has been added in lzma\/bcj.h for RISC-V, ARM64, and x86 systems.\n
The code for computing CLMUL CRC for x86, x86-64, and E2K systems has been rewritten.\n
On platforms with LoongArch processors, instructions are utilized to accelerate the calculation of CRC32 checksums.\n
In the 'xz' utility, the fsync() function is called to flush file caches for the resulting file before deleting the original file. An option '--no-sync' has been implemented to disable synchronization before deletion.\n
In the xz, xzdec, and lzmainfo utilities, non-printable characters are replaced with a question mark when outputting information to the screen.\n
In xz and xzdec on the Linux platform, support for versions 5 and 6 of the Landlock mechanism has been implemented to isolate processes.\n
A script for license checking build-aux\/license-check.sh has been added.\n
The scripts lzcmp, lzdiff, lzless, lzmore, lzgrep, lzegrep, and lzfgrep, which were implemented as extensions to the xz utility, have been deprecated. <\/ul>\n