CVE-2019-20021
Fixed in a distro release EPSS 1%
A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.
Products: upx, fedoraproject fedora
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | upx-ucl | 3.96-1 |
| Debian 14 | upx-ucl | 3.96-1 |
| SUSE Package Hub 15 SP1 | upx | 3.96-bp151.4.3.1 |
| Ubuntu 16.04 LTS | upx-ucl | no fix |
| Ubuntu 18.04 LTS | upx-ucl | no fix |
| Ubuntu 20.04 LTS | upx-ucl | no fix |
| openSUSE Leap 15.1 | upx | 3.96-lp151.3.3.1 |
| openSUSE Tumbleweed | upx | 3.96-3.2 |