Approved changes feed: RSS · Atom
cpe:2.3:a:upx:upx:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Upx (8335031a-9b21-5d0e-8eb9-001c3312aa3b) |
|---|---|
| Product | Upx (7793ee4a-e48c-55bb-bf1b-87176b820b36) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/upx/upx |
purl2cpe | 2026-06-01 10:17:47.499726 |
pkg:rpm/fedora/upx |
purl2cpe | 2026-06-01 10:17:47.499728 |
pkg:rpm/opensuse/upx |
purl2cpe | 2026-06-01 10:17:47.499729 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-2849 |
vulnerable | 2026-06-08 07:16:58.477418 |
UPX p_lx_elf.cpp un_DT_INIT heap-based overflow
LOW (3.3)
A vulnerability, which was classified as problematic, was found in UPX up to 5.0.0. Affected is the function PackLinuxElf64::un_DT_INIT of the file src/p_lx_elf.cpp. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as e0b6ff192412f5bb5364c1948f4f6b27a0cd5ea2. It is recommended to apply a patch to fix this issue.
Published: 2025-03-27T13:31:06.442Z
Updated: 2025-03-27T14:11:39.541Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-3209 |
vulnerable | 2026-06-08 06:41:52.693950 |
UPX bele.h get_ne64 heap-based overflow
MEDIUM (5.5)
A vulnerability was found in UPX up to 4.2.2. It has been rated as critical. This issue affects the function get_ne64 of the file bele.h. The manipulation leads to heap-based buffer overflow. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-259055. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2024-04-02T23:00:05.494Z
Updated: 2025-02-13T17:52:09.080Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-23457 |
vulnerable | 2026-06-08 05:56:02.670211 |
Upx: segv on packlinuxelf64::invert_pt_dynamic() in p_lx_elf.cpp
MEDIUM (5.3)
A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.
Published: 2023-01-12T00:00:00.000Z
Updated: 2025-04-07T15:31:13.258Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-23456 |
vulnerable | 2026-06-08 05:56:02.669581 |
Upx: heap-buffer-overflow in packtmt::pack()
MEDIUM (5.3)
A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
Published: 2023-01-12T00:00:00.000Z
Updated: 2024-12-11T19:02:29.592Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-46179 |
vulnerable | 2026-06-08 05:38:03.117351 |
Details available
Reachable Assertion vulnerability in upx before 4.0.0 allows attackers to cause a denial of service via crafted file passed to the the readx function.
Published: 2023-08-22T00:00:00.000Z
Updated: 2024-10-03T17:51:24.866Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43317 |
vulnerable | 2026-06-08 05:36:43.148507 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43316 |
vulnerable | 2026-06-08 05:36:43.148102 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43315 |
vulnerable | 2026-06-08 05:36:43.147695 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43314 |
vulnerable | 2026-06-08 05:36:43.147215 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43313 |
vulnerable | 2026-06-08 05:36:43.146695 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43312 |
vulnerable | 2026-06-08 05:36:43.146253 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-43311 |
vulnerable | 2026-06-08 05:36:43.145705 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-27790 |
vulnerable | 2026-06-08 05:23:53.195560 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-27788 |
vulnerable | 2026-06-08 05:23:53.195147 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-27787 |
vulnerable | 2026-06-08 05:23:53.194604 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-20805 |
vulnerable | 2026-06-08 05:13:41.609134 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.