Reachable Assertion vulnerability in upx before 4.0.0 allows attackers to cause a denial of service via crafted file passed to the the readx function.

A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func getle64().

A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func getle32(). The problem is essentially caused in PackLinuxElf32::elflookup() at plxelf.cpp:5349

A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func getle32(). The problem is essentially caused in PackLinuxElf64::elflookup() at plxelf.cpp:5404

A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func getle32(). The problem is essentially caused in PackLinuxElf32::elflookup() at plxelf.cpp:5368

A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func getle32(). The problem is essentially caused in PackLinuxElf32::elflookup() at plxelf.cpp:5382.

A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf32::invertptdynamic at plxelf.cpp:1688.

A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf64::invertptdynamic at plxelf.cpp:5239.

A Segmentation fault was found in UPX in invertptdynamic() function in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.

https://github.com/upx/upx/issues/631 https://github.com/upx/upx/commit/779b648c5f6aa9b33f4728f79dd4d0efec0bf860

A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in ptmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.

An floating point exception was discovered in the elflookup function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.

A heap-based buffer over-read was discovered in the getle64 function in bele.h in UPX 4.0.0 via a crafted Mach-O file.

A heap-based buffer over-read was discovered in the getle32 function in bele.h in UPX 4.0.0 via a crafted Mach-O file.

A heap-based buffer over-read was discovered in the accuagetbe32 function in miniacc.h in UPX 4.0.0 via a crafted Mach-O file.

An invalid memory address reference was discovered in the adjABS function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.

An invalid memory address reference was discovered in the elflookup function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.

A heap-based buffer over-read was discovered in the invertptdynamic function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.

An out-of-bounds read access vulnerability was discovered in UPX in PackLinuxElf64::canPack() function of plxelf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service.

A floating point exception issue was discovered in UPX in PackLinuxElf64::invertptdynamic() function of plxelf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service. The highest impact is to Availability.

A Segmentaation fault was found in UPX in invertptdynamic() function in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.

A heap buffer overflow read was discovered in upx 4.0.0, because the check in plxelf.cpp is not perfect.

An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.

Null pointer dereference was found in upx PackLinuxElf::canUnpack() in plxelf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.

Upstream issue:

https://github.com/upx/upx/issues/48

Upstream patch:

https://github.com/upx/upx/commit/90279abdfcd235172eab99651043051188938dcc

A flaw was found in upx canPack in plxelf.cpp in UPX 3.96 that allows attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impacts via a crafted ELF.

Upstream issue:

https://github.com/upx/upx/issues/421

plxelf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PTDYNAMIC segment.

An invalid memory address dereference was discovered in the canUnpack function in pmach.cpp in UPX 3.95 via a crafted Mach-O file.

A floating-point exception was discovered in PackLinuxElf::elfhash in plxelf.cpp in UPX 3.95. The vulnerability causes an application crash, which leads to denial of service.

A heap-based buffer over-read was discovered in canUnpack in pmach.cpp in UPX 3.95 via a crafted Mach-O file.

canUnpack in pvmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impact via a crafted UPX packed file.

An Integer overflow in the getElfSections function in pvmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an allocation of excessive memory.