Unscored CVE-2019-14295 EUVD-2019-5522GHSA-6m8h-vp4x-j6x4

An Integer overflow in the getElfSections function in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash)…

Published Jul 27, 2019 · Updated Aug 5, 2024 · Assigned by mitre

Package: upx-ucl Package: upx-ucl Ecosystem: Debian Ecosystem: Ubuntu

Description

An Integer overflow in the getElfSections function in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an allocation of excessive memory.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	upx-ucl	3.95-2	—
Debian 13	upx-ucl	3.95-2	—

Ubuntu