PT-2021-13877 · Upx+1 · Upx+1

Hustcw · Published 2021-03-26 · Updated 2025-04-11 · CVE-2021-20285

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:C

Name of the Vulnerable Software and Affected Versions: UPX version 3.96

Description: A flaw was found in upx canPack in p lx elf.cpp. This flaw allows attackers to cause a denial of service (SEGV or buffer overflow and application crash) or possibly have unspecified other impacts via a crafted ELF. The highest threat from this vulnerability is to system availability.

Recommendations: For UPX version 3.96, consider updating to a newer version that contains a fix for this issue, as the current version is affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

CVE-2021-20285

MGASA-2021-0241

OPENSUSE-SU-2023:0088-1

Affected Products

Debian

Upx

References · 43

• 🔥 https://github.com/upx/upx/issues/421 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-20285 · Security Note
• https://cve.org/CVERecord?id=CVE-2021-20285 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0241 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-20285 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-20285 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-20285 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20285 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2023:0088-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20285 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/VSQRO7YC72PSYDQG4PQLQYXZTZE3B4YV · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0241.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/G3BQABK4YLXENDJBLDMHAIPRTC3ZMLYK · Vendor Advisory
• https://suse.com/security/cve/CVE-2021-20285 · Note
• https://suse.com/security/cve/CVE-2023-23457 · Note