UNKNOWN READ vulnerability in upx
Summary
OSV-2024-98: UNKNOWN READ in PackLinuxElf32::adjABS. Affects upx across 2 version ranges.
>= 666b3c0f74efaa67858e109df93856a6f26f419c, < ae6d3b9bff87d43f4ef9b345c7c99c0a577a11dc
>= 10807ebdc212c44db366131e71b3e358643eae51
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
upx is an open-source executable packer for several executable formats. It is designed to reduce the size of executables and improve their loading time. The packer works by compressing the executable and decompressing it at runtime. This vulnerability affects the upx package and can lead to an UNKNOWN READ crash.
Vulnerability Detail
The vulnerability in upx is related to the PackLinuxElf32::adjABS function. When processing Linux ELF 32-bit executables, an UNKNOWN READ crash can occur in the adjABS function. This can be triggered during the unpacking process and may lead to a denial of service or potential code execution. The issue has been reported in the OSS-Fuzz project, and more details can be found in the provided link.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended approach is to update the upx package to a fixed version.
Conclusion
The UNKNOWN READ vulnerability in upx can be resolved by updating the package to a version that includes the fix. It is important to stay updated with the latest security patches to ensure the safety and stability of your software. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for upx →
FAQ
upx is an open-source executable packer used to reduce the size of executables and improve their loading time.
This vulnerability can lead to an UNKNOWN READ crash, potentially resulting in a denial of service or code execution.
To fix this vulnerability, update the upx package to a version that includes the fix.
More information about this vulnerability can be found in the provided OSS-Fuzz report link.
There is no specific workaround mentioned for this vulnerability. Updating the upx package is the recommended approach.
References
Related vulnerabilities
Recent vulnerabilities recorded for upx.
