Suggested advisory:
========================

The updated packages fix a security vulnerability:

XZ has a heap-use-after-free bug in threaded .xz decoder. (CVE-2025-31115)

References:
https://www.openwall.com/lists/oss-security/2025/04/03/1
========================

Updated packages in core/updates_testing:
========================
lib(64)lzma5-5.4.3-1.1.mga9
lib(64)lzma-devel-5.4.3-1.1.mga9
xz-5.4.3-1.1.mga9

from SRPM:
xz-5.4.3-1.1.mga9.src.rpm

Assignee: bugsquad => qa-bugs
Status: NEW => ASSIGNED
Status comment: Fixed upstream in 5.8.1 and patches available from upstream => (none)
Source RPM: xz-5.6.3-1.mga10.src.rpm, xz-5.4.3-1.mga9.src.rpm => xz-5.4.3-1.mga9.src.rpm
Whiteboard: MGA9TOO => (none)
Version: Cauldron => 9

RH x86_64

installing lib64lzma-devel-5.4.3-1.1.mga9.x86_64.rpm xz-5.4.3-1.1.mga9.x86_64.rpm lib64lzma5-5.4.3-1.1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/3: lib64lzma5            ##################################################################################################
      2/3: lib64lzma-devel       ##################################################################################################
      3/3: xz                    ##################################################################################################
      1/3: removing lib64lzma-devel-5.4.3-1.mga9.x86_64
                                 ##################################################################################################
      2/3: removing xz-5.4.3-1.mga9.x86_64
                                 ##################################################################################################
      3/3: removing lib64lzma5-5.4.3-1.mga9.x86_64
                                 ##################################################################################################

compress a video with xz
extract the .xz with xz -d 
It works

MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Ref bug 30261 Comment 7
$ xz arsmusica1.avi 
During the operation:
$ ls -als  a*
1014828 -rw------- 1 tester9 tester9 1039212544 Apr  5 16:17 arsmusica1.avi
 139436 -rw-rw-r-- 1 tester9 tester9  142777888 Jan  4  2011 arsmusica1.avi.xz
Finally
$ ls -als a*
139436 -rw-rw-r-- 1 tester9 tester9 142777888 Jan  4  2011 arsmusica1.avi.xz
[tester9@mach3 Videos]$ xz -d arsmusica1.avi.xz 
After decompression
$ ls -als  a*
4396588 -rw-rw-r-- 1 tester9 tester9 4502133916 Jan  4  2011 arsmusica1.avi
And resulting file plays OK

CC: (none) => herman.viaene
Whiteboard: (none) => MGA9-64-OK

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs

Used to extract and create sources for packaging without issues

Keywords: (none) => advisory

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2025-0131.html

Resolution: (none) => FIXED
Status: ASSIGNED => RESOLVED