CVE-2019-20053
Fixed in a distro release EPSS 1%
An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.
Products: upx, opensuse backports, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 13 | upx-ucl | 3.96-1 |
| Debian 14 | upx-ucl | 3.96-1 |
| SUSE Package Hub 15 SP1 | upx | 3.96-bp151.4.3.1 |
| Ubuntu 16.04 LTS | upx-ucl | no fix |
| Ubuntu 18.04 LTS | upx-ucl | no fix |
| Ubuntu 20.04 LTS | upx-ucl | no fix |
| openSUSE Leap 15.1 | upx | 3.96-lp151.3.3.1 |
| openSUSE Tumbleweed | upx | 3.96-3.2 |