Advisory ROSA-SA-2024-2414

software: upx 4.2.1
OS: ROSA-CHROME

package_evr_string: upx-4.2.1-1

CVE-ID: CVE-2023-23456
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC.: A heap buffer overflow problem was discovered in UPX in PackTmt::pack() in the file p_tmt.cpp. This thread allows an attacker to cause a denial of service (interrupt) using the file created.
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update upx

CVE-ID: CVE-2023-23457
BDU-ID: None
CVE-Crit: MEDIUM
CVE-DESC.: A segmentation error was detected in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker using the created input file allows access to an invalid memory address, which can lead to a denial of service.
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update upx