CVE-2021-30501

An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.

References

Affected packages

Debian:11 / upx-ucl

Package

Name: upx-ucl
Purl: pkg:deb/debian/upx-ucl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

3.*

3.96-2

3.96-2+deb11u1

3.96-3

4.*

4.2.2-1

4.2.2-2

4.2.2-3~bpo12+1

4.2.2-3

4.2.4-1

4.2.4-1.1

Ecosystem specific

{
    "urgency": "unimportant"
}

Debian:13 / upx-ucl

Package

Name: upx-ucl
Purl: pkg:deb/debian/upx-ucl?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

4.2.2-1

Ecosystem specific

{
    "urgency": "unimportant"
}

Git / github.com/upx/upx

Affected ranges

Type: GIT
Repo: https://github.com/upx/upx
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

28e761cd42211dfe0124b7a29b2f74730f453e46