Bugzilla – Bug 1186238
VUL-0: CVE-2020-24119: upx: heap buffer overflow in p_lx_elf.cpp
Last modified: 2021-10-14 09:29:04 UTC
CVE-2020-24119 A heap buffer overflow read was discovered in upx 4.0.0, because the check in p_lx_elf.cpp is not perfect. https://github.com/upx/upx/issues/388 References: https://bugzilla.redhat.com/show_bug.cgi?id=1961591 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-24119 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24119 https://github.com/upx/upx/issues/388
Upstream patch: https://github.com/upx/upx/commit/87b73e5cfdc12da94c251b2cd83bb01c7d9f616c.patch
This is an autogenerated message for OBS integration: This bug (1186238) was mentioned in https://build.opensuse.org/request/show/894328 Factory / upx
RQs posted.
This is an autogenerated message for OBS integration: This bug (1186238) was mentioned in https://build.opensuse.org/request/show/895296 15.2 / upx https://build.opensuse.org/request/show/895297 Backports:SLE-15-SP3 / upx
openSUSE-SU-2021:0813-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1186238 CVE References: CVE-2020-24119 JIRA References: Sources used: openSUSE Leap 15.2 (src): upx-3.96-lp152.2.3.1 openSUSE Backports SLE-15-SP3 (src): upx-3.96-bp153.2.3.1
openSUSE-SU-2021:0826-1: An update that fixes one vulnerability is now available. Category: security (moderate) Bug References: 1186238 CVE References: CVE-2020-24119 JIRA References: Sources used: openSUSE Backports SLE-15-SP2 (src): upx-3.96-bp152.2.3.1
done