diff --git a/NEWS b/NEWS index c1870e89..812124e9 100644 --- a/NEWS +++ b/NEWS @@ -2,6 +2,145 @@ XZ Utils Release Notes ====================== +5.8.4 (2026-09-09) + + IMPORTANT: This includes a fix for a security issue that affects all + XZ Utils versions since 5.0.0. This and a few other fixes have also + been committed to the old stable branches (v5.2, v5.4, and v5.6) in + the xz Git repository. Those fixes are marked below. No new 5.2.x, + 5.4.x, or 5.6.x releases will be made. + + * liblzma: + + - lzma_alone_decoder(), lzma_lzip_decoder(), + lzma_auto_decoder(), and lzma_microlzma_decoder(): Fix an + invalid memory access after memory allocation has failed and + the application reinitializes the existing decoder to decode + a different file. This bug could at least result in a crash. + This is tracked as GHSA-5qpq-xqfv-j9pg. CVE number is pending. + (Also in v5.2, v5.4, and v5.6.) + + - lzma_stream_buffer_decode(): Fix wrong error code and, + in debug builds, assertion failure. LZMA_BUF_ERROR could + be returned with truncated inputs while LZMA_DATA_ERROR + is the correct one in this function. + (Also in v5.2, v5.4, and v5.6.) + + - Fix a performance issue in the typical use case of + lzma_index_cat(). Internally liblzma calls it from + lzma_file_info_decoder(), so that was affected too. The + problem occurred if the input .xz file was created by + concatenating a large number of .xz files. A crafted file + could make "xz --list" very slow or effectively hang. + Normal decompression doesn't use these functions and + thus wasn't affected. + (Also in v5.2, v5.4, and v5.6.) + + - Fix a theoretical integer overflow in lzma_index_cat(). + (Also in v5.2, v5.4, and v5.6.) + + - Fix bogus memory usage report in lzma_index_decoder() when + the .xz Index is obviously invalid. A huge bogus value could + cause an integer overflow in lzma_file_info_decoder()'s + memory usage reporting due to a missing overflow check, + making lzma_memused() report an incorrect tiny value. This + bug didn't affect the memory usage limiter in these two + decoders; only the reporting via lzma_memused() was affected. + (Also in v5.2, v5.4, and v5.6.) + + - Fix a too low memory usage report in lzma_index_decoder() + if lzma_memused() is called after a part of the Index has + already been decoded. The typical use case is to call + lzma_memused() immediately after LZMA_MEMLIMIT_ERROR, + which did work correctly. + + - Fix copying of check type in lzma_index_dup(). Calling + lzma_index_checks() on the duplicated lzma_index returned + return garbage a result. lzma_index_dup() is rarely used; + liblzma doesn't use it internally and xz itself doesn't use + it either. + (Also in v5.2, v5.4, and v5.6.) + + - lzma_file_info_decoder() and lzma_index_decoder(): Reject + an obviously-invalid Number of Records field earlier. + (Partially also in v5.2, v5.4, and v5.6.) + + - Fix a missing synchronization in the threaded .xz decoder. It + could make lzma_get_progress() return incorrect progress info. + (Also in v5.4 and v5.6.) + + - Detect certain kinds of corrupt inputs slightly earlier in + the LZMA2 decoder. + + - ARM64 and LoongArch: Don't use aligned reads on unaligned + buffers. This makes the code work on strict-align processors + and fixes a sanitizer error in other cases. (Since 5.7.1alpha) + + * xz: + + - Fix a use-after-free when showing an error message if --files + or --files0 was specified in the environment variables XZ_OPT + or XZ_DEFAULTS. + (Also in v5.2, v5.4, and v5.6.) + + - Fix a use-after-free bug when --verbose is used and + standard error isn't a terminal. (Since 5.7.1alpha) + + - Make it an error if the totals in "xz --list" exceed the range + of 64-bit integers. + (Also in v5.2, v5.4, and v5.6.) + + * xz and xzdec on Linux: + + - Add support for Landlock ABI version 9. + + - Use fallback macros for Landlock ABI version 2, 3, and 5 + (but not 4) if is older than ABI version 5. + This makes the binary slightly more protected if it is run on + a kernel that supports newer ABIs than . + + * Scripts: + + - xzgrep: Fix handling of the ' char at the end of a command + line option. For example, the following tricked xzgrep to + run "id": xzgrep "-e'" "-e;id;'" somefile + (Also in v5.2, v5.4, and v5.6.) + + - xzdiff: Use the C locale (LC_ALL=C) with "sed" and "expr" + to ensure safe behavior with invalid multibyte sequences. + An equivalent improvement was made in xzgrep in 5.2.6 + (2022-08-12), but it was forgotten from xzdiff. + (Also in v5.2, v5.4, and v5.6.) + + * Tests: + + - Improve a few tests and fuzz targets. + + - Add new test files: + * bad-0-index-1.xz (32 bytes) + * bad-1-index-huge-uncomp.xz (72 bytes) + + * Man pages: + + - Improve the rendering with OpenBSD's mandoc(1). + + - Reduce indentation of the tables to avoid overlong lines + in translated versions of the xz man page. + + * Translations: + + - In translated man pages, workaround an issue with non-ASCII + characters in tables. + + - Fix syntax errors in a few man page translations. + + - Update Arabic and German man page translations. + + - Update Brazilian Portuguese, Croatian, Dutch, German, Italian, + Korean, Polish, Portuguese, Romanian, and Ukrainian message + translations. + + 5.8.3 (2026-03-31) IMPORTANT: This includes a fix for CVE-2026-34743 which affects all