CVE-2021-30500: Null Pointer Dereference

Published Apr 12, 2021

Updated

Null pointer dereference was found in upx PackLinuxElf::canUnpack() in plxelf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.

Upstream issue:

https://github.com/upx/upx/issues/48

Upstream patch:

https://github.com/upx/upx/commit/90279abdfcd235172eab99651043051188938dcc

Affected Software

3 affected components

Upx Project Upx=4.0.0

redhat Enterprise Linux=7.0

Fedoraproject Fedora=33

Remediation

Patch Available

https://github.com/upx/upx/commit/90279abdfcd235172eab99651043051188938dcc

Event History

Apr 12, 2021

Data Sourced

via Red Hat·06:37 PM

DescriptionSeverityAffected Software

May 26, 2021

CVE Published

via MITRE·11:51 PM

Data Sourced

via MITRE·11:51 PM

DescriptionWeakness

Frequently Asked Questions

What is the vulnerability ID for this issue?

The vulnerability ID for this issue is CVE-2021-30500.

What is the severity of CVE-2021-30500?

The severity of CVE-2021-30500 is high.

What is the affected software of CVE-2021-30500?

The affected software of CVE-2021-30500 includes UPX 4.0.0, Redhat Enterprise Linux 7.0, and Fedoraproject Fedora 33.

How can attackers exploit CVE-2021-30500?

Attackers can exploit CVE-2021-30500 by executing arbitrary code and causing a denial of service via a crafted file.

Are there any references available for CVE-2021-30500?

Yes, you can refer to the following links for more information: [Link 1](https://bugzilla.redhat.com/show_bug.cgi?id=1948692), [Link 2](https://github.com/upx/upx/commit/90279abdfcd235172eab99651043051188938dcc), [Link 3](https://github.com/upx/upx/issues/485).