Format: 1.8
Date: Mon, 15 Apr 2024 14:15:02 -0700
Source: xz-utils
Binary: liblzma5 liblzma5-udeb xz-utils xzdec liblzma-dev liblzma-doc
Architecture: source
Version: 5.4.6-0ubuntu1~16.04.sav1
Distribution: xenial
Urgency: medium
Maintainer: Jonathan Nieder <jrnieder@gmail.com>
Changed-By: Rob Savoury <savoury@savos.tech>
Description:
 liblzma-dev - XZ-format compression library - development files
 liblzma-doc - XZ-format compression library - API documentation
 liblzma5   - XZ-format compression library
 liblzma5-udeb - XZ-format compression library (udeb)
 xz-utils   - XZ-format compression utilities
 xzdec      - XZ-format compression utilities - tiny decompressors
Changes:
 xz-utils (5.4.6-0ubuntu1~16.04.sav1) xenial; urgency=medium
 .
   * Response to CVE-2024-3094 backdoor (new upstream changes from April 2024):
     - d/patches/: Add cve-2024-3094-doc-changes-part{1,2,3}.patch (upstream)
         to show current correct maintainer and URL info (removes "Jia Tan")
       - Add cve-2024-3094-doc-changes-part4.patch to purge the evildoer from
         documentation in several additional files not yet changed by upstream
     - NOTE: No ifunc support was in any xz-utils source prior to v5.5.1alpha,
       and at this time all available information about CVE-2024-3094 says that
       the backdoor relied upon ifunc to operate, so this version 5.4.6 should
       not be vulnerable (and as soon as upstream makes a new release with all
       changes by "Jia Tan" removed that release will be published at the PPAs)
Checksums-Sha1:
 94ee334bf1988ee5a64f4f6428b98801be9b58f1 2512 xz-utils_5.4.6-0ubuntu1~16.04.sav1.dsc
 4753de10a7f07cc8b787a241b7443fbae8d639ee 31576 xz-utils_5.4.6-0ubuntu1~16.04.sav1.debian.tar.xz
Checksums-Sha256:
 c1407301da2a0cc8317466e98fddea0af066b37ef575b2e0120fd2f2d5fbf182 2512 xz-utils_5.4.6-0ubuntu1~16.04.sav1.dsc
 3bc7d27ed8bc7f7865963e73cde9f5f6d17d5a7c9a522bba5d5d40a584f4ac0e 31576 xz-utils_5.4.6-0ubuntu1~16.04.sav1.debian.tar.xz
Files:
 21ef203a6195c49f425f4674d952a564 2512 utils optional xz-utils_5.4.6-0ubuntu1~16.04.sav1.dsc
 41e76782ce729f638c13ea50af8aa901 31576 utils optional xz-utils_5.4.6-0ubuntu1~16.04.sav1.debian.tar.xz