DATABASE RESOURCES PRICING ABOUT US

{"id": "VERACODE:37845", "vendorId": null, "type": "veracode", "bulletinFamily": "software", "title": "Denial Of Service (DoS)", "description": "upx is vulnerable to denial of service. The vulnerability exists due to the invalid memory address references in `elf_lookup` function of `p_lx_elf.cpp`, allowing an attacker to cause an application crash through the maliciously crafted `Mach-O` file \n", "published": "2022-11-08T12:10:50", "modified": "2022-11-09T02:30:23", "cvss": {"score": 0.0, "vector": "NONE"}, "cvss2": {}, "cvss3": {"cvssV3": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM"}, "exploitabilityScore": 1.8, "impactScore": 3.6}, "href": "https://sca.analysiscenter.veracode.com/vulnerability-database/security/1/1/sid-37845/summary", "reporter": "Veracode Vulnerability Database", "references": ["https://secdb.alpinelinux.org/edge/community.yaml", "https://github.com/upx/upx/issues/390"], "cvelist": ["CVE-2020-27797"], "immutableFields": [], "lastseen": "2022-11-10T00:34:16", "viewCount": 0, "enchantments": {"dependencies": {"references": [{"type": "alpinelinux", "idList": ["ALPINE:CVE-2020-27797"]}, {"type": "cve", "idList": ["CVE-2020-27797"]}, {"type": "debiancve", "idList": ["DEBIANCVE:CVE-2020-27797"]}, {"type": "ubuntucve", "idList": ["UB:CVE-2020-27797"]}]}, "score": {"value": 3.4, "vector": "NONE"}, "affected_software": {"major_version": [{"name": "upx:edge", "version": 3}, {"name": "upx:edge", "version": 3}, {"name": "upx:edge", "version": 3}, {"name": "upx:edge", "version": 3}, {"name": "upx:edge", "version": 3}, {"name": "upx:edge", "version": 3}]}, "epss": [{"cve": "CVE-2020-27797", "epss": "0.000440000", "percentile": "0.104970000", "modified": "2023-03-20"}], "vulnersScore": 3.4}, "_state": {"dependencies": 1668040458, "score": 1668040766, "affected_software_major_version": 1668043699, "epss": 1679345642}, "_internal": {"score_hash": "e9141a1059e43797fb196f39580fe964"}, "affectedSoftware": [{"version": "3.96-r2", "operator": "eq", "name": "upx:edge"}, {"version": "3.96-r1", "operator": "eq", "name": "upx:edge"}, {"version": "3.96-r0", "operator": "eq", "name": "upx:edge"}, {"version": "3.96-r2", "operator": "eq", "name": "upx:edge"}, {"version": "3.96-r1", "operator": "eq", "name": "upx:edge"}, {"version": "3.96-r0", "operator": "eq", "name": "upx:edge"}]}

{"alpinelinux": [{"lastseen": "2022-10-29T19:02:11", "description": "An invalid memory address reference was discovered in the elf_lookup function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2022-08-25T20:15:00", "type": "alpinelinux", "title": "CVE-2020-27797", "bulletinFamily": "unix", "cvss2": {}, "cvelist": ["CVE-2020-27797"], "modified": "2022-08-27T03:11:00", "id": "ALPINE:CVE-2020-27797", "href": "https://security.alpinelinux.org/vuln/CVE-2020-27797", "cvss": {"score": 0.0, "vector": "NONE"}}], "debiancve": [{"lastseen": "2022-08-27T10:06:04", "description": "An invalid memory address reference was discovered in the elf_lookup function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2022-08-25T20:15:00", "type": "debiancve", "title": "CVE-2020-27797", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-27797"], "modified": "2022-08-25T20:15:00", "id": "DEBIANCVE:CVE-2020-27797", "href": "https://security-tracker.debian.org/tracker/CVE-2020-27797", "cvss": {"score": 0.0, "vector": "NONE"}}], "ubuntucve": [{"lastseen": "2023-01-27T13:16:25", "description": "An invalid memory address reference was discovered in the elf_lookup\nfunction in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2022-08-25T00:00:00", "type": "ubuntucve", "title": "CVE-2020-27797", "bulletinFamily": "info", "cvss2": {}, "cvelist": ["CVE-2020-27797"], "modified": "2022-08-25T00:00:00", "id": "UB:CVE-2020-27797", "href": "https://ubuntu.com/security/CVE-2020-27797", "cvss": {"score": 0.0, "vector": "NONE"}}], "cve": [{"lastseen": "2023-02-09T15:17:27", "description": "An invalid memory address reference was discovered in the elf_lookup function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file.", "cvss3": {"exploitabilityScore": 1.8, "cvssV3": {"baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "attackComplexity": "LOW", "scope": "UNCHANGED", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "baseScore": 5.5, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1", "userInteraction": "REQUIRED"}, "impactScore": 3.6}, "published": "2022-08-25T20:15:00", "type": "cve", "title": "CVE-2020-27797", "cwe": ["CWE-763"], "bulletinFamily": "NVD", "cvss2": {}, "cvelist": ["CVE-2020-27797"], "modified": "2022-08-27T03:11:00", "cpe": ["cpe:/a:upx_project:upx:4.0.0"], "id": "CVE-2020-27797", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-27797", "cvss": {"score": 0.0, "vector": "NONE"}, "cpe23": ["cpe:2.3:a:upx_project:upx:4.0.0:*:*:*:*:*:*:*"]}]}