Bug#1031874: upx-ucl: CVE-2023-23457

From	Moritz Mühlenhoff <jmm@inutil.org>
Newsgroups	linux.debian.bugs.rc
Subject	Bug#1031874: upx-ucl: CVE-2023-23457
Date	2023-02-24 17:10 +0100
Message-ID	<G2INX-8clR-1@gated-at.bofh.it> (permalink)
Organization	linux.* mail to news gateway

Show all headers | View raw

Source: upx-ucl
X-Debbugs-CC: team@security.debian.org
Severity: grave
Tags: security

Hi,

The following vulnerability was published for upx-ucl.

CVE-2023-23457[0]:
| A Segmentation fault was found in UPX in
| PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with
| a crafted input file allows invalid memory address access that could
| lead to a denial of service.

https://github.com/upx/upx/issues/631
https://github.com/upx/upx/commit/779b648c5f6aa9b33f4728f79dd4d0efec0bf860
		

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-23457
    https://www.cve.org/CVERecord?id=CVE-2023-23457

Please adjust the affected versions in the BTS as needed.

Back to linux.debian.bugs.rc | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1031874: upx-ucl: CVE-2023-23457 Moritz Mühlenhoff <jmm@inutil.org> - 2023-02-24 17:10 +0100
  Bug#1031874: upx-ucl: CVE-2023-23457 Michael Prokop <mika@debian.org> - 2023-10-09 17:30 +0200

csiph-web