Malicious Code in XZ Utils for Linux Systems Enables Remote Code Execution

The malicious code inserted into the open-source library XZ Utils, a widely used package present in major Linux distributions, is also capable of facilitating remote code execution, a new analysis has revealed.
The audacious supply chain compromise, tracked as CVE-2024-3094 (CVSS score: 10.0), came to light last week when Microsoft engineer and PostgreSQL developer Andres Freund

analysis code code execution compromise cve cve-2024 cve-2024-3094 cvss cvss score distributions library linux linux distributions linux systems major malicious package remote code remote code execution score supply supply chain supply chain compromise systems week xz utils