Log in Start free

Vulnerability · Published Jan 12, 2023 · Assigned by fedora

CVE-2023-23456Upx: heap-buffer-overflow in packtmt::pack()

Medium 5.3

In plain English

A medium-severity out-of-bounds write in upx. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.4%top 65.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20upx4.0.2-r0ALPINE-CVE-2023-23456
Alpine:v3.21upx4.0.2-r0ALPINE-CVE-2023-23456
Alpine:v3.22upx4.0.2-r0ALPINE-CVE-2023-23456
Alpine:v3.23upx4.0.2-r0ALPINE-CVE-2023-23456
Alpine:v3.24upx4.0.2-r0ALPINE-CVE-2023-23456
Debian:13upx-ucl4.2.2-1DEBIAN-CVE-2023-23456
Debian:14upx-ucl4.2.2-1DEBIAN-CVE-2023-23456
Ubuntu:24.04:LTSupx-uclno fix listedUBUNTU-CVE-2023-23456
Ubuntu:25.10upx-uclno fix listedUBUNTU-CVE-2023-23456
Ubuntu:26.04:LTSupx-uclno fix listedUBUNTU-CVE-2023-23456
Ubuntu:26.10upx-uclno fix listedUBUNTU-CVE-2023-23456

Affected products (as reported)

VendorProductVersions
upx see references

Weakness: CWE-787 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

References