tukaani.org » XZ Utils

Introduction

XZ Utils are a complete C99 implementation of the .xz file format. XZ Utils were originally written for POSIX systems but have been ported to a few non-POSIX systems as well.

The core of the XZ Utils compression code is based on LZMA SDK but it has been modified significantly to be suitable for XZ Utils.

XZ Utils consist of several components:

  • liblzma is a compression library with an API similar to that of zlib.

  • xz is a command line tool with syntax similar to that of gzip.

  • xzdec is a decompression-only tool smaller than the full-featured xz tool.

  • A set of shell scripts (xzgrep, xzdiff, etc.) have been adapted from gzip to ease viewing, grepping, and comparing compressed files.

Documentation

Man pages with keyword indexes:

liblzma API documentation was generated using Doxygen.

Security issues

CVE-2025-31115: Threaded .xz decoder frees memory too early

In XZ Utils 5.3.3alpha to 5.8.0, the multithreaded .xz decoder in liblzma has a bug where invalid input can at least result in a crash.

Thanks to Harri K. Koskinen for discovering and reporting this issue.

CVE-2024-47611: Argument injection on Windows

When built for native Windows (mingw-w64 or MSVC), the command line tools from XZ Utils 5.6.2 and older have a command line argument injection vulnerability. Command line tools built for Cygwin or MSYS2 are unaffected. liblzma is unaffected.

This issue was discovered by Orange Tsai and splitline from DEVCORE Research Team.

CVE-2024-3094: liblzma backdoor

XZ Utils 5.6.0 (2024-02-24) and 5.6.1 (2024-03-09) release tarballs contain a backdoor that was inserted by a malicious co-maintainer. It was discovered by Andres Freund and made public on 2024-03-29. The incident is known as CVE-2024-3094.

This is still being investigated. See the XZ Utils backdoor page for more information and also the XZ Utils review notes.

CVE-2022-1271: xzgrep filename handling

CVE-2022-1271 is also known as ZDI-CAN-16587.

Malicious filenames can make xzgrep to write to arbitrary files or (with a GNU sed extension) lead to arbitrary code execution. A patch to fix it was made public on 2022-04-07. The patch applies to 4.999.9beta, 5.0.0 to 5.2.5, 5.3.1alpha, and 5.3.2alpha. Newer XZ Utils releases include an improved fix for the problem.

xzgrep-ZDI-CAN-16587.patch — signature

The vulnerability was discovered by cleemy desu wayo working with Trend Micro Zero Day Initiative.

CVE-2020-22916: A bogus CVE

CVE-2020-22916 is bogus; it’s not a security issue or a bug.

The report had a corrupt .lzma file which uses a tiny 256-byte dictionary. So decompression needs very little memory. The reporter claimed that decompressing it “could cause endless output”.

Both XZ Utils and the long-deprecated LZMA Utils produce 114,881,179 bytes of output from the file before reporting an error. This is not “endless output”. The decompression speed is good too.

Source packages

See the NEWS file for a summary of changes between versions.

The releases have been signed with Lasse Collin’s OpenPGP key.

Stable

XZ Utils 5.8.1 fix a security issue. The fix is also available in the Git repository in the affected stable branches, and a standalone patch is available as well. See the security advisory for details.

5.8.1 (2025-04-03)

xz-5.8.1.tar.gz

2527 KiB

signature

xz-5.8.1.tar.bz2

1858 KiB

signature

xz-5.8.1.tar.xz

1428 KiB

signature

xz-5.8.1.tar

signature

XZ Utils source packages are also available on Sourceforge.

It is fine to build packages from the Git repository instead of using the release tarballs. Use either a tag that matches a release (v5.x.x) or the latest commit of a stable branch (v5.x). See the Development section below.

Old releases

Source and binary packages of the old XZ Utils releases are available on a separate page.

Development

The primary Git repository is on GitHub:

git clone https://github.com/tukaani-project/xz

The repository is mirrored (with some delay) to git.tukaani.org as well.

The master branch contains the latest development code.

Maintenance status of the stable branches:

  • v5.8: maintained

  • v5.6: critical fixes only (no new releases)

  • v5.4: critical fixes only (no new releases)

  • v5.2: unmaintained

  • v5.0: unmaintained

The other branches on GitHub are temporary development branches which also see force pushes. These branches aren’t mirrored to git.tukaani.org.

Building from xz.git

Two multi-platform build systems are supported:

  • The GNU Autotools-based build is old, feature complete, and the most tested. Apart from Windows, DOS, and OpenVMS, the Autotools-based build is the most likely to work on less common or old platforms. Run ./autogen.sh to generate the configure script and other files.

  • CMake-based build became feature complete in June 2024. However, it hasn’t received as much testing as the Autotools-based build. See the notes at the top of CMakeLists.txt.

Special cases: OpenVMS and DOS builds use different build systems. See the file INSTALL.

Minimum Autotools and CMake versions

For GNU Autotools, it is recommended to use the latest versions. The minimum versions required are old though:

  • Autoconf 2.69

  • Automake 1.12

  • gettext 0.19.6

  • Libtool 2.4

For the CMake build, version 3.20 or greater is required. Translation support also requires that GNU gettext-tools are installed.

Optional dependencies

po4a is needed for translated documentation (man pages).

  • Autotools: To build without po4a, pass --no-po4a as the argument to autogen.sh.

  • CMake: Run the shell script po4a/update-po to generate the translated man pages inside the source tree (thus the source tree will have extra files; it won’t stay completely clean). If the translated man pages exist in the source tree, make install will install them if translation support was enabled (XZ_NLS).

Doxygen can be used to generate liblzma API documentation in HTML format which make install will also install. Doxygen usage is disabled by default.

  • Autotools: Pass --enable-doxygen as an argument to configure.

  • CMake: Pass -DXZ_DOXYGEN=ON as an argument to cmake.

Future build system plans

People have wished for Meson support and work on it has been started.

While dropping Autotools is tempting, there are use cases where Autotools have benefits still:

  • Easier bootstrapping on modern operating systems. muon might make this easier with Meson-based build though.

  • Better support for old or obscure operating systems. As time goes on, these get less and less important though.

Bindings

Binary packages

Many free software operating systems already provide easy-to-install XZ Utils binaries. It doesn’t make sense to provide links to all those here.

Windows

The 5.8.0 binaries have been built with GCC 14.2.0 and mingw-w64 12.0.0 against UCRT. They should work on Windows 10 and later. They might work on older Windows versions if UCRT has been installed.

It’s unknown if new binary releases will be made in the future.

5.8.1 (2025-04-03)

xz-5.8.1-windows.zip

1056 KiB

signature

xz-5.8.1-windows.7z

646 KiB

signature

Supported platforms

Below is an incomplete and somewhat vague (version numbers mostly missing) list of operating systems on which XZ Utils should work. Compiler(s) or toolchains are mentioned in parenthesis. GCC refers to GCC 3 or later. If Clang/LLVM is available for the operating system then it should work too. Additions and corrections are welcome.

  • GNU/Linux (GCC, Clang, ICC, ICX, XL C)

  • GNU/Hurd (GCC)

  • DragonflyBSD

  • FreeBSD

  • MirBSD

  • NetBSD

  • OpenBSD

  • MINIX 3.3.0 and later [1]

  • Haiku

  • SerenityOS

  • AROS and AmigaOS

  • macOS / Mac OS X / Darwin

  • Solaris 10, 11 (GCC, Sun Studio / Oracle Developer Studio) [1]

  • AIX (GCC, XL C) [1]

  • z/OS UNIX System Services (XL C) [1]

  • QNX

  • HP-UX (GCC, HP ANSI C) [2]

  • OpenVMS (HP C compiler) [1]

  • OpenVOS 17 (GCC)

  • Windows 2000 and later (GCC or Clang/LLVM with mingw-w64, GCC/Cygwin, Visual Studio 2015 or later) [1]

  • DOS e.g. FreeDOS and MS-DOS (GCC/DJGPP) [1]

XZ Utils have or had support for the following operating systems but recent releases might not work anymore. If the latest XZ Utils don’t work, try XZ Utils 5.4.7 or an even older release. Support for obsolete operating systems and versions might be retained or restored if it is easy to do.

  • Solaris 9 and older [3]

  • IRIX (MIPSpro) [1]

  • Tru64 (GCC, Compaq C compiler) [4]

  • SCO OpenServer 5 (GCC 3.4.6, 4.2.4) [5]

  • Windows 95/98/98SE/ME, NT4, Interix (pre-W2k support was disabled after XZ Utils 5.4.x)

  • OS/2, eComStation (GCC)

Licensing

From the version 5.5.2beta onwards, the core components of XZ Utils are under the BSD Zero Clause License (0BSD). The earlier versions that were released as public domain obviously remain in the public domain.

Some parts of XZ Utils (for example, scripts from GNU gzip and some build system files) are under different free software licenses such as GNU LGPLv2.1, GNU GPLv2, or GNU GPLv3.

See the file COPYING for more details.

Reporting bugs

Bugs can be reported on GitHub or via email or IRC. If a security issue has been discovered, please report it privately via email (encrypted if possible) or use the Report a vulnerability button in the security section on GitHub.

Bugs in translations should be reported to the appropriate translation team. See the Language-Team and Last-Translator fields in the PO file header. A few translations include the bug reporting address at the bottom of xz --help too. See also the xz (command line tools) and xz-man (man pages) domains in the Translation Project.

1. See also the platform-specific notes in the INSTALL file.
2. 2010-09-22: It was reported that HP ANSI C compiler crashes when compiling XZ Utils on PA-RISC. On Itanium there were no problems.
3. On Solaris 8 and 9 one may need to pass ac_cv_prog_cc_c99= to configure if using Sun Studio.
4. With the native compiler CC=cc one may need to pass ac_cv_prog_cc_c99= to configure.
5. On SCO OpenServer 5, use --disable-threads when running configure.

tukaani.org » XZ Utils