CVE-2019-20021: Medium severity upx vulnerability
A heap-based buffer over-read was discovered in canUnpack in pmach.cpp in UPX 3.95 via a crafted Mach-O file.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2019-20021?
CVE-2019-20021 is a vulnerability discovered in UPX 3.95 that allows a heap-based buffer over-read via a crafted Mach-O file.
What is the severity of CVE-2019-20021?
The severity of CVE-2019-20021 is medium with a CVSS score of 5.5.
Which software versions are affected by CVE-2019-20021?
UPX 3.95, Fedora 30, and Fedora 31 are affected by CVE-2019-20021.
How can the vulnerability be exploited?
The vulnerability can be exploited by providing a crafted Mach-O file to the canUnpack function in UPX 3.95.
Where can I find more information about CVE-2019-20021?
You can find more information about CVE-2019-20021 on the following references: [Reference 1](http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00003.html), [Reference 2](http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00007.html), and [Reference 3](https://github.com/upx/upx/issues/315).