PT-2025-13195 · Upx+2 · Upx+2

Madao123123 · Published 2025-03-27 · Updated 2025-06-16 · CVE-2025-2849

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions UPX versions up to 5.0.0

Description A problematic issue was found in the function PackLinuxElf64::un DT INIT of the file src/p lx elf.cpp, leading to a heap-based buffer overflow. The attack can be launched on the local host.

Recommendations Apply a patch to fix this issue, specifically the patch identified as e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2.

Exploit

Fix

Memory Corruption

Heap Based Buffer Overflow

Buffer Overflow

Weakness Enumeration

CWE-787

CWE-122

CWE-119

Related Identifiers

BDU:2025-06969

CVE-2025-2849

MGASA-2025-0122

OPENSUSE-SU-2025:14947-1

Affected Products

Debian

Red Os

Upx

References · 26

• 🔥 https://github.com/upx/upx/issues/898 · Exploit
• 🔥 https://github.com/upx/upx/issues/898#issuecomment-2734082143 · Exploit
• 🔥❌ https://github.com/user-attachments/files/19307868/input.zip · Exploit, Deleted
• https://github.com/upx/upx/commit/e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-2849 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2849 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:14947-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2849 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-2849 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06969 · Security Note
• https://advisories.mageia.org/MGASA-2025-0122.html · Security Note
• https://osv.dev/vulnerability/MGASA-2025-0122 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-2849 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-2849 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-2849 · Security Note