CVE-2019-14296
Fixed in a distro release EPSS 2%
canUnpack in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impact via a crafted UPX packed file.
Products: upx
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | upx-ucl | 3.95-2 |
| Debian 14 | upx-ucl | 3.95-2 |
| SUSE Package Hub 15 SP1 | upx | 3.96-bp151.4.3.1 |
| Ubuntu 16.04 LTS | upx-ucl | no fix |
| Ubuntu 18.04 LTS | upx-ucl | no fix |
| openSUSE Leap 15.1 | upx | 3.96-lp151.3.3.1 |
| openSUSE Tumbleweed | upx | 3.96-3.2 |