Lucene search

GoogleOSV:CVE-2023-23456

HistoryJan 12, 2023 - 7:15 p.m.

CVE-2023-23456

2023-01-1219:15:24

Google

osv.dev

cve-2023-23456

heap-based buffer overflow

denial of service

upx

packtmt::pack()

p_tmt.cpp file

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.9%

JSON

A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.

CPENameOperatorVersion
upxeq1.95
upxeq3.05
upxeq4.0.1
upxeq3.02
upxeq1.91
upxeq2.90
upxeq1.94
upxeq1.11
upxeq3.04
upxeq1.92

Name	Operator	Version
upx	eq	1.95
upx	eq	3.05
upx	eq	4.0.1
upx	eq	3.02
upx	eq	1.91
upx	eq	2.90
upx	eq	1.94
upx	eq	1.11
upx	eq	3.04
upx	eq	1.92

Rows per page:

1-10 of 341

References

bugzilla.redhat.com/show_bug.cgi?id=2160381

github.com/upx/upx/commit/510505a85cbe45e51fbd470f1aa8b02157c429d4

github.com/upx/upx/issues/632

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EL3BVKIGG3SH6I3KPOYQAWCBD4UMPOPI/

lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGEP3FBNRZXGLIA2B2ICMB32JVMPREFZ/

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

5.4 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

31.9%

JSON

Related for OSV:CVE-2023-23456