CVE-2020-27796: Buffer Overflow
Published Aug 25, 2022
·Updated
A heap-based buffer over-read was discovered in the invertptdynamic function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.
Affected Software
10 affected componentsFixes available
Upx Project Upx=4.0.0
UPX upx=4.0.0
alpine/upx<4.0.0-r0
4.0.0-r0
alpine/upx<4.0.0-r0
4.0.0-r0
alpine/upx<4.0.0-r0
4.0.0-r0
alpine/upx<4.0.0-r0
4.0.0-r0
alpine/upx<4.0.0-r0
4.0.0-r0
alpine/upx<4.0.0-r0
4.0.0-r0
alpine/upx<4.0.0-r0
4.0.0-r0
alpine/upx<4.0.0-r0
4.0.0-r0
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
alpine/upxto a version that resolves this vulnerability.Fixed in 4.0.0-r0
Event History
Aug 25, 2022
CVE Published
via MITRE·07:37 PM
Data Sourced
via MITRE·07:37 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
DescriptionSeverityWeaknessAffected Software
Data Sourced
via OSV·08:15 PM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2020-27796.
2
What is the severity of CVE-2020-27796?
The severity of CVE-2020-27796 is high with a score of 7.8.
3
What is the affected software?
The affected software is UPX version 4.0.0.
4
How does the vulnerability occur?
The vulnerability occurs due to a heap-based buffer over-read in the invert_pt_dynamic function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file.
5
Is there a fix available for CVE-2020-27796?
Yes, the UPX project has addressed the vulnerability in newer versions. It is recommended to update to the latest version of UPX to fix CVE-2020-27796.