CVE-2021-43315: Buffer Overflow
Published Mar 24, 2023
·Updated
A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func getle32(). The problem is essentially caused in PackLinuxElf32::elflookup() at plxelf.cpp:5349
Affected Software
1 affected component
Upx Project Upx<4.0.0
Remediation
Patch Available
Event History
Mar 24, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this heap-based buffer overflow in upx?
The vulnerability ID for this heap-based buffer overflow in upx is CVE-2021-43315.
2
What is the severity rating for CVE-2021-43315?
The severity rating for CVE-2021-43315 is high with a value of 7.5.
3
Which version of upx is affected by CVE-2021-43315?
The versions of upx up to and excluding 4.0.0 are affected by CVE-2021-43315.
4
What is the root cause of buffer overflow in upx?
The buffer overflow in upx is caused by a heap-based buffer overflow in the function get_le32() when the generic pointer 'p' points to an inaccessible address.
5
Is there a fix available for CVE-2021-43315?
Yes, it is recommended to update upx to a version beyond 4.0.0 to mitigate the vulnerability.