A flaw was found in upx canPack in plxelf.cpp in UPX 3.96 that allows attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impacts via a crafted ELF.

Upstream issue:

https://github.com/upx/upx/issues/421

DISPUTED pmach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever."

plxelf.cpp in UPX 3.94 mishandles ELF headers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by an Invalid Pointer Read in PackLinuxElf64::unpack().

Null pointer dereference was found in upx PackLinuxElf::canUnpack() in plxelf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.

Upstream issue:

https://github.com/upx/upx/issues/48

Upstream patch:

https://github.com/upx/upx/commit/90279abdfcd235172eab99651043051188938dcc

canUnpack in pvmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impact via a crafted UPX packed file.

PackLinuxElf64::unpack in plxelf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a crafted file.

A heap-based buffer over-read was discovered in the getle32 function in bele.h in UPX 4.0.0 via a crafted Mach-O file.

A heap-based buffer over-read was discovered in the invertptdynamic function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.

A heap-based buffer over-read was discovered in the getle64 function in bele.h in UPX 4.0.0 via a crafted Mach-O file.

A heap-based buffer over-read was discovered in the accuagetbe32 function in miniacc.h in UPX 4.0.0 via a crafted Mach-O file.

A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func getle64().

A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func getle32(). The problem is essentially caused in PackLinuxElf32::elflookup() at plxelf.cpp:5349

A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func getle32(). The problem is essentially caused in PackLinuxElf64::elflookup() at plxelf.cpp:5404

A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func getle32(). The problem is essentially caused in PackLinuxElf32::elflookup() at plxelf.cpp:5368

A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func getle32(). The problem is essentially caused in PackLinuxElf32::elflookup() at plxelf.cpp:5382.

A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf32::invertptdynamic at plxelf.cpp:1688.

A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the function PackLinuxElf64::invertptdynamic at plxelf.cpp:5239.

A heap buffer overflow read was discovered in upx 4.0.0, because the check in plxelf.cpp is not perfect.

Reachable Assertion vulnerability in upx before 4.0.0 allows attackers to cause a denial of service via crafted file passed to the the readx function.

A floating-point exception was discovered in PackLinuxElf::elfhash in plxelf.cpp in UPX 3.95. The vulnerability causes an application crash, which leads to denial of service.

An invalid memory address dereference was discovered in the canUnpack function in pmach.cpp in UPX 3.95 via a crafted Mach-O file.

A heap-based buffer over-read was discovered in canUnpack in pmach.cpp in UPX 3.95 via a crafted Mach-O file.

An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.

plxelf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PTDYNAMIC segment.

An Integer overflow in the getElfSections function in pvmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an allocation of excessive memory.

A floating point exception issue was discovered in UPX in PackLinuxElf64::invertptdynamic() function of plxelf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service. The highest impact is to Availability.

An out-of-bounds read access vulnerability was discovered in UPX in PackLinuxElf64::canPack() function of plxelf.cpp file. An attacker with a crafted input file could trigger this issue that could cause a crash leading to a denial of service.

A Segmentaation fault was found in UPX in invertptdynamic() function in plxelf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.

An floating point exception was discovered in the elflookup function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.

An invalid memory address reference was discovered in the elflookup function in plxelf.cpp in UPX 4.0.0 via a crafted Mach-O file.