See how upx compares to other vendors in security performance
A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::unDTINIT of the file src/plxelf.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2. It is recommended to apply a patch to fix this issue.
A vulnerability was found in UPX up to 4.2.2. It has been rated as critical. This issue affects the function getne64 of the file bele.h. The manipulation leads to heap-based buffer overflow. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259055. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.1. The flow allows attackers to cause a denial of service (abort) via a crafted file.
https://github.com/upx/upx/issues/632 https://github.com/upx/upx/commit/510505a85cbe45e51fbd470f1aa8b02157c429d4
A Segmentation fault was found in UPX in invertptdynamic() function in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.
https://github.com/upx/upx/issues/631 https://github.com/upx/upx/commit/779b648c5f6aa9b33f4728f79dd4d0efec0bf860
A Segmentation fault was found in UPX in invertptdynamic() function in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.
https://github.com/upx/upx/issues/631 https://github.com/upx/upx/commit/779b648c5f6aa9b33f4728f79dd4d0efec0bf860
A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in ptmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
An floating point exception was discovered in the elflookup function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.
A heap-based buffer over-read was discovered in the getle64 function in bele.h in UPX 4.0.0 via a crafted Mach-O file.
A heap-based buffer over-read was discovered in the getle32 function in bele.h in UPX 4.0.0 via a crafted Mach-O file.
A heap-based buffer over-read was discovered in the accuagetbe32 function in miniacc.h in UPX 4.0.0 via a crafted Mach-O file.
An invalid memory address reference was discovered in the adjABS function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.
An invalid memory address reference was discovered in the elflookup function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.
A heap-based buffer over-read was discovered in the invertptdynamic function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.
A heap buffer overflow read was discovered in upx 4.0.0, because the check in plxelf.cpp is not perfect.
An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.
Upstream issue:
https://github.com/upx/upx/issues/486
Upstream patch: https://github.com/upx/upx/pull/487 https://github.com/upx/upx/commit/28e761cd42211dfe0124b7a29b2f74730f453e46
An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.
Null pointer dereference was found in upx PackLinuxElf::canUnpack() in plxelf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.
Upstream issue:
https://github.com/upx/upx/issues/48
Upstream patch:
https://github.com/upx/upx/commit/90279abdfcd235172eab99651043051188938dcc
Null pointer dereference was found in upx PackLinuxElf::canUnpack() in plxelf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.
Upstream issue:
https://github.com/upx/upx/issues/48
Upstream patch:
https://github.com/upx/upx/commit/90279abdfcd235172eab99651043051188938dcc
A flaw was found in upx canPack in plxelf.cpp in UPX 3.96 that allows attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impacts via a crafted ELF.
Upstream issue:
https://github.com/upx/upx/issues/421
A flaw was found in upx canPack in plxelf.cpp in UPX 3.96 that allows attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impacts via a crafted ELF.
Upstream issue:
https://github.com/upx/upx/issues/421
An invalid memory address dereference was discovered in the canUnpack function in pmach.cpp in UPX 3.95 via a crafted Mach-O file.
A heap-based buffer over-read was discovered in canUnpack in pmach.cpp in UPX 3.95 via a crafted Mach-O file.
canUnpack in pvmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impact via a crafted UPX packed file.
PackLinuxElf64::unpack in plxelf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a crafted file.