PT-2017-13841 · Upx Team+1 · Upx+1

Hongphipham95 · Published 2017-10-06 · Updated 2025-04-11 · CVE-2017-15056

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UPX version 3.94

Description The issue is related to the handling of ELF headers in the p lx elf.cpp file, which can be exploited by remote attackers using a crafted binary file. This exploitation can lead to a denial of service, causing the application to crash, and potentially have other unspecified impacts. The vulnerability is demonstrated by an Invalid Pointer Read in the PackLinuxElf64::unpack() function.

Recommendations For UPX version 3.94, consider updating to a newer version that addresses this issue, as the current version mishandles ELF headers, leading to potential security risks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2019-1210

ALT-PU-2020-2930

CVE-2017-15056

MGASA-2017-0389

Affected Products

Alt Linux

Upx

References · 62

• https://github.com/upx/upx/issues/128 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27787 · Security Note
• https://errata.altlinux.org/ALT-PU-2019-1210 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0389 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27790 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-15056 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20053 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15056 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24119 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27799 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20021 · Security Note
• https://cve.org/CVERecord?id=CVE-2017-15056 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20805 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-27801 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30501 · Security Note