CVE-2025-2849 | Low | 3.3 | 2025-03-27 | A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of the file src/p_lx_el… |
CVE-2024-3209 | Medium | 5.5 | 2024-04-02 | A vulnerability was found in UPX up to 4.2.2. It has been rated as critical. This issue affects the function get_ne64 of the file bele.h. The manipulation lead… |
CVE-2021-46179 | Medium | 6.5 | 2023-08-22 | Reachable Assertion vulnerability in upx before 4.0.0 allows attackers to cause a denial of service via crafted file passed to the the readx function. |
CVE-2021-43317 | High | 7.5 | 2023-03-24 | A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essent… |
CVE-2021-43316 | High | 7.5 | 2023-03-24 | A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le64(). |
CVE-2021-43315 | High | 7.5 | 2023-03-24 | A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essent… |
CVE-2021-43314 | High | 7.5 | 2023-03-24 | A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essent… |
CVE-2021-43313 | High | 7.5 | 2023-03-24 | A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the functio… |
CVE-2021-43312 | High | 7.5 | 2023-03-24 | A heap-based buffer overflow was discovered in upx, during the variable 'bucket' points to an inaccessible address. The issue is being triggered in the functio… |
CVE-2021-43311 | High | 7.5 | 2023-03-24 | A heap-based buffer overflow was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essenti… |
CVE-2023-23457 | Medium | 5.3 | 2023-01-12 | A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory addre… |
CVE-2023-23456 | Medium | 5.3 | 2023-01-12 | A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort)… |
CVE-2020-27802 | Medium | 5.5 | 2022-08-25 | An floating point exception was discovered in the elf_lookup function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file. |
CVE-2020-27801 | High | 7.8 | 2022-08-25 | A heap-based buffer over-read was discovered in the get_le64 function in bele.h in UPX 4.0.0 via a crafted Mach-O file. |
CVE-2020-27800 | High | 7.8 | 2022-08-25 | A heap-based buffer over-read was discovered in the get_le32 function in bele.h in UPX 4.0.0 via a crafted Mach-O file. |
CVE-2020-27799 | High | 7.8 | 2022-08-25 | A heap-based buffer over-read was discovered in the acc_ua_get_be32 function in miniacc.h in UPX 4.0.0 via a crafted Mach-O file. |
CVE-2020-27798 | Medium | 5.5 | 2022-08-25 | An invalid memory address reference was discovered in the adjABS function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file. |
CVE-2020-27797 | Medium | 5.5 | 2022-08-25 | An invalid memory address reference was discovered in the elf_lookup function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file. |
CVE-2020-27796 | High | 7.8 | 2022-08-25 | A heap-based buffer over-read was discovered in the invert_pt_dynamic function in p_lx_elf.cpp in UPX 4.0.0 via a crafted Mach-O file. |
CVE-2020-27788 | Medium | 5.5 | 2022-08-18 | An out-of-bounds read access vulnerability was discovered in UPX in PackLinuxElf64::canPack() function of p_lx_elf.cpp file. An attacker with a crafted input f… |
CVE-2020-27790 | Medium | 5.5 | 2022-08-18 | A floating point exception issue was discovered in UPX in PackLinuxElf64::invert_pt_dynamic() function of p_lx_elf.cpp file. An attacker with a crafted input f… |
CVE-2020-27787 | Medium | 5.5 | 2022-08-18 | A Segmentaation fault was found in UPX in invert_pt_dynamic() function in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address acc… |
CVE-2021-30501 | Medium | 5.5 | 2021-05-27 | An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a c… |
CVE-2021-30500 | High | 7.8 | 2021-05-27 | Null pointer dereference was found in upx PackLinuxElf::canUnpack() in p_lx_elf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and ca… |
CVE-2020-24119 | High | 7.1 | 2021-05-14 | A heap buffer overflow read was discovered in upx 4.0.0, because the check in p_lx_elf.cpp is not perfect. |
CVE-2021-20285 | Medium | 6.6 | 2021-03-26 | A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (SEGV or buffer overflow and application c… |
CVE-2019-20805 | Medium | 5.5 | 2020-06-01 | p_lx_elf.cpp in UPX before 3.96 has an integer overflow during unpacking via crafted values in a PT_DYNAMIC segment. |
CVE-2019-20053 | Medium | 5.5 | 2019-12-27 | An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file. |
CVE-2019-20051 | Medium | 5.5 | 2019-12-27 | A floating-point exception was discovered in PackLinuxElf::elf_hash in p_lx_elf.cpp in UPX 3.95. The vulnerability causes an application crash, which leads to… |
CVE-2019-20021 | Medium | 5.5 | 2019-12-27 | A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file. |
CVE-2019-14296 | High | 7.8 | 2019-07-27 | canUnpack in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have un… |
CVE-2019-14295 | Medium | 5.5 | 2019-07-27 | An Integer overflow in the getElfSections function in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash) via a skewed offset… |
CVE-2018-11243 | High | 7.8 | 2018-05-18 | PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of a malware scanner t… |
CVE-2017-16869 | High | 7.8 | 2017-11-17 | p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other im… |
CVE-2017-15056 | High | 7.8 | 2017-10-06 | p_lx_elf.cpp in UPX 3.94 mishandles ELF headers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified ot… |