CVE-2021-30500

Null pointer dereference was found in upx PackLinuxElf::canUnpack() in plxelf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.

References

Affected packages

Debian:11 / upx-ucl

Package

Name: upx-ucl
Purl: pkg:deb/debian/upx-ucl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.96-2

3.96-2+deb11u1

3.96-3

4.*

4.2.2-1

4.2.2-2

4.2.2-3~bpo12+1

4.2.2-3

4.2.4-1

4.2.4-1.1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / upx-ucl

Package

Name: upx-ucl
Purl: pkg:deb/debian/upx-ucl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.2-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Git / github.com/upx/upx

Affected ranges

Type: GIT
Repo: https://github.com/upx/upx
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

90279abdfcd235172eab99651043051188938dcc