# Affected Product: XZ (product=xz) CVEs that affect a product whose CPE product name is xz. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/enrichment-cpe-product/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs that affect a product whose CPE product name is xz. Example 3 of 14 in **Filters › Affected Products (CPE)** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `enrichment.cpe.product` · `operator` `eq` `enrichment.cpe.product` is the product part of the CPE name (`log4j`, `windows`). `eq` matches the exact value `xz`. In the response, look at `results[].enrichment.cpe[].product`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `enrichment.cpe.product` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `xz` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "enrichment.cpe.product", "type": "eq", "value": "xz" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 6 shown; results[].references: first 10 items; results[].enrichment.cwe[].capec_id: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 6, "results": [ { "id": "CVE-2024-3094", "source_identifier": "user@redhat.com", "published": "2024-03-29T17:15:21Z", "last_modified": "2026-06-17T07:43:17Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. \r\nThrough a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then used to modify specific functions in the liblzma code. This results in a modified liblzma library that can be used by any software linked against this library, intercepting and modifying the data interaction with this library." }, { "lang": "es", "value": "Se descubrió código malicioso en los archivos tar ascendentes de xz, a partir de la versión 5.6.0. A través de una serie de ofuscaciones complejas, el proceso de compilación de liblzma extrae un archivo objeto premanipulado de un archivo de prueba disfrazado existente en el código fuente, que luego se utiliza para modificar funciones específicas en el código de liblzma. Esto da como resultado una librería liblzma modificada que puede ser utilizada por cualquier software vinculado a esta librería, interceptando y modificando la interacción de datos con esta librería." } ], "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2024-3094", "source": "user@redhat.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2272210", "source": "user@redhat.com", "tags": [ "Issue Tracking", "Vendor Advisory" ] }, { "url": "https://www.openwall.com/lists/oss-security/2024/03/29/4", "source": "user@redhat.com", "tags": [ "Mailing List" ] }, { "url": "https://www.redhat.com/en/blog/urgent-security-alert-fedora-41-and-rawhide-users", "source": "user@redhat.com", "tags": [ "Vendor Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/10", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/12", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/4", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/5", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/29/8", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null }, { "url": "http://www.openwall.com/lists/oss-security/2024/03/30/12", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@redhat.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@redhat.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-506" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*", "match_criteria_id": "73F1DAD7-F362-4C5B-B980-2E5313C369DA", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*", "match_criteria_id": "55782A0B-B9C5-4536-A885-84CAB7029C09", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:tukaani:xz:5.6.0:*:*:*:*:*:*:*", "vendor": "tukaani", "product": "xz", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "5.6.0", "affected_versions_last": "5.6.0" }, { "criteria": "cpe:2.3:a:tukaani:xz:5.6.1:*:*:*:*:*:*:*", "vendor": "tukaani", "product": "xz", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "5.6.1", "affected_versions_last": "5.6.1" } ], "cwe": [ { "id": 506, "owasptop10_2021": null, "name": "Embedded Malicious Code", "description": "The product contains code that appears to be malicious in nature.", "capec_id": [ 442, 448, 636 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "Execute Unauthorized Code or Commands" ], "detection_method": [ "Automated Static Analysis", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.85974, "percentile": 0.99719, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2022-1271", "source_identifier": "user@redhat.com", "published": "2022-08-31T16:15:09Z", "last_modified": "2026-06-17T04:22:07Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker's content to an arbitrary attacker-selected file. This flaw occurs due to insufficient validation when processing filenames with two or more newlines where selected content and the target file names are embedded in crafted multi-line file names. This flaw allows a remote, low privileged attacker to force zgrep to write arbitrary files on the system." }, { "lang": "es", "value": "Se encontró una vulnerabilidad de escritura arbitraria de archivos en la utilidad zgrep de GNU gzip. Cuando zgrep es aplicado sobre el nombre de archivo elegido por el atacante (por ejemplo, un nombre de archivo diseñado), éste puede sobrescribir el contenido de un archivo arbitrario seleccionado por el atacante. Este fallo es producido debido a una comprobación insuficiente cuando son procesados nombres de archivo con dos o más líneas nuevas en los que el contenido seleccionado y los nombres de archivo de destino están insertados en nombres de archivo multilínea diseñados. Este fallo permite a un atacante remoto poco privilegiado forzar a zgrep a escribir archivos arbitrarios en el sistema" } ], "references": [ { "url": "https://access.redhat.com/security/cve/CVE-2022-1271", "source": "user@redhat.com", "tags": [ "Third Party Advisory" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073310", "source": "user@redhat.com", "tags": [ "Issue Tracking", "Third Party Advisory" ] }, { "url": "https://git.tukaani.org/?p=xz.git%3Ba=commit%3Bh=69d1b3fc29677af8ade8dc15dba83f0589cb63d6", "source": "user@redhat.com", "tags": [ "Broken Link" ] }, { "url": "https://lists.gnu.org/r/bug-gzip/2022-04/msg00011.html", "source": "user@redhat.com", "tags": [ "Mailing List", "Patch", "Vendor Advisory" ] }, { "url": "https://security-tracker.debian.org/tracker/CVE-2022-1271", "source": "user@redhat.com", "tags": [ "Third Party Advisory" ] }, { "url": "https://security.gentoo.org/glsa/202209-01", "source": "user@redhat.com", "tags": [ "Third Party Advisory" ] }, { "url": "https://security.netapp.com/advisory/ntap-20220930-0006/", "source": "user@redhat.com", "tags": [ "Third Party Advisory" ] }, { "url": "https://tukaani.org/xz/xzgrep-ZDI-CAN-16587.patch", "source": "user@redhat.com", "tags": [ "Patch", "Third Party Advisory" ] }, { "url": "https://www.openwall.com/lists/oss-security/2022/04/07/8", "source": "user@redhat.com", "tags": [ "Mailing List", "Patch", "Third Party Advisory" ] }, { "url": "https://access.redhat.com/security/cve/CVE-2022-1271", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "LOW", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 8.8, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.8, "impact_score": 5.9 }, { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "LOW", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 8.8, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.8, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@redhat.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-179" } ] }, { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-20" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:gnu:gzip:*:*:*:*:*:*:*:*", "match_criteria_id": "AE211FFB-B5CC-4827-9430-D58DA7D9EF09", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.12" } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*", "match_criteria_id": "CD354E32-A8B0-484C-B4C6-9FBCD3430D2D", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "match_criteria_id": "07B237A9-69A3-4A9C-9DA0-4E06BD37AE73", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] }, { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:tukaani:xz:*:*:*:*:*:*:*:*", "match_criteria_id": "B815FE77-341C-45D5-B7C5-5A828AE7764A", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "5.2.5" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:gnu:gzip:*:*:*:*:*:*:*:*", "vendor": "gnu", "product": "gzip", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "1.12", "affected_versions_first": "1.2.4a", "affected_versions_last": "1.11" }, { "criteria": "cpe:2.3:a:redhat:jboss_data_grid:7.0.0:*:*:*:*:*:*:*", "vendor": "redhat", "product": "jboss_data_grid", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "7.0.0", "affected_versions_last": "7.0.0" }, { "criteria": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*", "vendor": "debian", "product": "debian_linux", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "10.0", "affected_versions_last": "10.0" }, { "criteria": "cpe:2.3:a:tukaani:xz:*:*:*:*:*:*:*:*", "vendor": "tukaani", "product": "xz", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "5.2.5", "affected_versions_first": "4.42.2", "affected_versions_last": "5.2.4" } ], "cwe": [ { "id": 179, "owasptop10_2021": null, "name": "Incorrect Behavior Order: Early Validation", "description": "The product validates input before applying protection mechanisms that modify the input, which could allow an attacker to bypass the validation via dangerous inputs that only arise after the modification.", "capec_id": [ 3, 43, 71 ], "scope": [ "Access Control", "Integrity" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands" ], "detection_method": null }, { "id": 20, "owasptop10_2021": "A03 Injection", "name": "Improper Input Validation", "description": "The product receives input or data, but it does\n not validate or incorrectly validates that the input has the\n properties that are required to process the data safely and\n correctly.", "capec_id": [ 3, 7, 8, 9, 10, 13, 14, 22, 23, 24 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "DoS: Crash, Exit, or Restart", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)", "Execute Unauthorized Code or Commands", "Modify Memory", "Read Files or Directories", "Read Memory" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Fuzzing", "Manual Static Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.0507, "percentile": 0.9195, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "LOW", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 8.8, "base_severity": "HIGH" } } } }, { "id": "CVE-2015-4035", "source_identifier": "user@mitre.org", "published": "2017-07-25T18:29:00Z", "last_modified": "2026-06-17T00:26:40Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "scripts/xzgrep.in in xzgrep 5.2.x before 5.2.0, before 5.0.0 does not properly process file names containing semicolons, which allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name." }, { "lang": "es", "value": "El archivo scripts/xzgrep.in en xzgrep en versión 5.2.x anterior a la 5.0.0, hay una vulnerabilidad que no procesa de manera apropiada los nombres de los archivos que contienen punto y coma, lo que permite a los atacantes remotos ejecutar código arbitrario haciendo que un usuario ejecute xzgrep en un nombre de archivo creado." } ], "references": [ { "url": "http://seclists.org/oss-sec/2015/q2/484", "source": "user@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2015/05/19/13", "source": "user@mitre.org", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1223341", "source": "user@mitre.org", "tags": [ "Issue Tracking", "Vendor Advisory" ] }, { "url": "https://git.tukaani.org/?p=xz.git%3Ba=commitdiff%3Bh=f4b2b52624b802c786e4e2a8eb6895794dd93b24", "source": "user@mitre.org", "tags": null }, { "url": "http://seclists.org/oss-sec/2015/q2/484", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "http://www.openwall.com/lists/oss-security/2015/05/19/13", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Mailing List", "Third Party Advisory" ] }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1223341", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Issue Tracking", "Vendor Advisory" ] }, { "url": "https://git.tukaani.org/?p=xz.git%3Ba=commitdiff%3Bh=f4b2b52624b802c786e4e2a8eb6895794dd93b24", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": null } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": null, "cvss_metric_v30": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "LOCAL", "attack_complexity": "LOW", "privileges_required": "LOW", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 7.8, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 1.8, "impact_score": 5.9 } ], "cvss_metric_v2": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "2.0", "vector_string": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "access_vector": "LOCAL", "access_complexity": "LOW", "authentication": "NONE", "confidentiality_impact": "PARTIAL", "integrity_impact": "PARTIAL", "availability_impact": "PARTIAL", "base_score": 4.6, "exploitability": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "collateral_damage_potential": null, "target_distribution": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "environmental_score": null }, "base_severity": "MEDIUM", "exploitability_score": 3.9, "impact_score": 6.4, "ac_insuf_info": false, "obtain_all_privilege": false, "obtain_user_privilege": false, "obtain_other_privilege": false, "user_interaction_required": false } ] }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-20" } ] } ], "configurations": [ { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:tukaani:xz:*:beta:*:*:*:*:*:*", "match_criteria_id": "15576D97-2E36-4DF4-9309-2D93486CEE5E", "version_start_including": null, "version_start_excluding": null, "version_end_including": "4.999.9", "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*", "match_criteria_id": "1D8B549B-E57B-4DFE-8A13-CAB06B5356B3", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "match_criteria_id": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:tukaani:xz:*:beta:*:*:*:*:*:*", "vendor": "tukaani", "product": "xz", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": "4.999.9", "version_end_excluding": null, "affected_versions_first": "4.999.7", "affected_versions_last": "4.999.9" }, { "criteria": "cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*", "vendor": "redhat", "product": "enterprise_linux", "product_type": "o", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "5.0", "affected_versions_last": "5.0" }, { "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "vendor": "redhat", "product": "enterprise_linux", "product_type": "o", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "6.0", "affected_versions_last": "6.0" } ], "cwe": [ { "id": 20, "owasptop10_2021": "A03 Injection", "name": "Improper Input Validation", "description": "The product receives input or data, but it does\n not validate or incorrectly validates that the input has the\n properties that are required to process the data safely and\n correctly.", "capec_id": [ 3, 7, 8, 9, 10, 13, 14, 22, 23, 24 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "DoS: Crash, Exit, or Restart", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)", "Execute Unauthorized Code or Commands", "Modify Memory", "Read Files or Directories", "Read Memory" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Fuzzing", "Manual Static Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.0099, "percentile": 0.61056, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.0", "2.0" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.0", "vector_string": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "LOCAL", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "LOW", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 7.8, "base_severity": "HIGH" } } } } ] } ``` ## Related Examples - [MOVEit Transfer CVEs Other Than the 2023 Mass Exploitation](/reference/vulnerability/search/examples/moveit-except-cve-2023-34362/) - [Sort by Id: Newest Log4j CVEs First](/reference/vulnerability/search/examples/sort-id/) - [Sort by Deepinfo Score: Lowest First](/reference/vulnerability/search/examples/sort-base-score/) - [Sort by Deepinfo Severity](/reference/vulnerability/search/examples/sort-base-severity/) - [Affected Vendor: GitLab](/reference/vulnerability/search/examples/enrichment-cpe-vendor/) - [Affected Hardware](/reference/vulnerability/search/examples/enrichment-cpe-product-type/)