Fedora 36 : upx (2023-8d91390935)

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-8d91390935 advisory. Patches for CVE-2023-23456 and CVE-2023-23457 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Fedora: Security Advisory for upx (FEDORA-2023-8d91390935)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for upx (FEDORA-2023-89fdc22ace)

The remote host is missing an update for the Copyright C 2023 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora 37 : upx (2023-89fdc22ace)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-89fdc22ace advisory. Patches for CVE-2023-23456 and CVE-2023-23457 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to a segmentation fault, via the PackLinuxElf64::invertptdynamic function in the plxelf.cpp file. Details Denial of Service DoS describes a family of attacks, all aimed at making a system inaccessible to its...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the PackTmt::pack function in the ptmt.cpp file. The flow allows an attacker to cause an abort via a crafted file. Remediation Upgrade upx to version 4.2.1 or higher. References - GitHub Commit - GitHub...

CVE-2023-23456

A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack in ptmt.cpp file. The flow allows an attacker to cause a denial of service abort via a crafted file...

CVE-2023-23457

A Segmentation fault was found in UPX in PackLinuxElf64::invertptdynamic in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service...

CVE-2023-23457

A Segmentation fault was found in UPX in PackLinuxElf64::invertptdynamic in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service...

DEBIAN-CVE-2023-23457

A Segmentation fault was found in UPX in PackLinuxElf64::invertptdynamic in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service...

DEBIAN-CVE-2023-23456

A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack in ptmt.cpp file. The flow allows an attacker to cause a denial of service abort via a crafted file...

Heap overflow

A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack in ptmt.cpp file. The flow allows an attacker to cause a denial of service abort via a crafted file...

CVE-2023-23456

A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack in ptmt.cpp file. The flow allows an attacker to cause a denial of service abort via a crafted file...

CVE-2023-23457

A Segmentation fault was found in UPX in PackLinuxElf64::invertptdynamic in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service...

Design/Logic Flaw

A Segmentation fault was found in UPX in PackLinuxElf64::invertptdynamic in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service...

UBUNTU-CVE-2023-23457

A Segmentation fault was found in UPX in PackLinuxElf64::invertptdynamic in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service...

CVE-2023-23456

CVE-2023-23456 concerns UPX, the executable packer. A heap-based buffer overflow in UPX’s PackTmt::pack() (p_tmt.cpp) can be triggered by a crafted file, enabling a denial of service via abort/memory corruption. Public advisories across distros confirm the issue; patches exist in several releases...

CVE-2023-23457

CVE-2023-23457 — UPX denial of service A vulnerability exists in UPX where a crafted input file can trigger a segmentation fault in PackLinuxElf64::invert_pt_dynamic() (p_lx_elf.cpp), allowing an attacker to cause invalid memory access and Denial of Service. Public advisories (openSUSE, Fedora) r...

CVE-2023-23456 Upx: heap-buffer-overflow in packtmt::pack()

A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack in ptmt.cpp file. The flow allows an attacker to cause a denial of service abort via a crafted file...

CVE-2023-23457 Upx: segv on packlinuxelf64::invert_pt_dynamic() in p_lx_elf.cpp

A Segmentation fault was found in UPX in PackLinuxElf64::invertptdynamic in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service...