CVE-2023-23456: Upx: heap-buffer-overflow in packtmt::pack()
First published: Thu Jan 12 2023(Updated: )
A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
Credit: patrick@puiterwijk.org patrick@puiterwijk.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Upx Project Upx | <2022-11-24 | |
| Fedoraproject Fedora | =36 | |
| Fedoraproject Fedora | =37 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=2160381
- https://github.com/upx/upx/commit/510505a85cbe45e51fbd470f1aa8b02157c429d4
- https://github.com/upx/upx/issues/632
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EL3BVKIGG3SH6I3KPOYQAWCBD4UMPOPI/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TGEP3FBNRZXGLIA2B2ICMB32JVMPREFZ/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2160384
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=2160383
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EL3BVKIGG3SH6I3KPOYQAWCBD4UMPOPI/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGEP3FBNRZXGLIA2B2ICMB32JVMPREFZ/
- https://lists.debian.org/debian-lts-announce/2024/12/msg00013.html
Frequently Asked Questions
What is CVE-2023-23456?
CVE-2023-23456 is a heap-based buffer overflow vulnerability discovered in UPX in the PackTmt::pack() function in the p_tmt.cpp file.
What is the severity of CVE-2023-23456?
The severity of CVE-2023-23456 is medium with a CVSS severity score of 5.5.
How does the vulnerability in CVE-2023-23456 impact users?
The vulnerability in CVE-2023-23456 allows an attacker to cause a denial of service (abort) by exploiting a heap-based buffer overflow issue in UPX.
What software versions are affected by CVE-2023-23456?
The affected software versions include UPX version up to exclusive 2022-11-24, and Fedora versions 36 and 37.
How can the vulnerability in CVE-2023-23456 be fixed?
To fix the vulnerability in CVE-2023-23456, users should update UPX to a version that includes the fix, or apply the necessary patches provided by the software vendor.
- collector/nvd-index
- agent/type
- agent/softwarecombine
- agent/weakness
- agent/remedy
- agent/references
- agent/title
- agent/description
- agent/first-publish-date
- agent/event
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2023-23456
- agent/severity
- agent/author
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- vendor/upx project
- canonical/upx project upx
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/36
- version/fedoraproject fedora/37