Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2019-1010048 (GCVE-0-2019-1010048)
Vulnerability from cvelistv5
DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
Show details on NVD website{
"containers": {
"cna": {
"providerMetadata": {
"dateUpdated": "2019-07-17T13:19:51",
"orgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8",
"shortName": "dwf"
},
"rejectedReasons": [
{
"lang": "en",
"value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "7556d962-6fb7-411e-85fa-6cd62f095ba8",
"assignerShortName": "dwf",
"cveId": "CVE-2019-1010048",
"datePublished": "2019-07-16T13:30:53",
"dateRejected": "2019-07-17T13:19:51",
"dateReserved": "2019-03-20T00:00:00",
"dateUpdated": "2019-07-17T13:19:51",
"state": "REJECTED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.0",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2019-1010048\",\"sourceIdentifier\":\"josh@bress.net\",\"published\":\"2019-07-16T14:15:11.810\",\"lastModified\":\"2023-11-07T03:02:15.490\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none\"}],\"metrics\":{},\"references\":[]}}"
}
}
fkie_cve-2019-1010048
Vulnerability from fkie_nvd
Published
2019-07-16 14:15
Modified
2023-11-07 03:02
Severity ?
Summary
Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none
References
| ▶ | URL | Tags |
|---|
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none"
}
],
"id": "CVE-2019-1010048",
"lastModified": "2023-11-07T03:02:15.490",
"metrics": {},
"published": "2019-07-16T14:15:11.810",
"references": [],
"sourceIdentifier": "josh@bress.net",
"vulnStatus": "Rejected"
}
opensuse-su-2020:0163-1
Vulnerability from csaf_opensuse
Published
2020-02-04 09:13
Modified
2020-02-04 09:13
Summary
Security update for upx
Notes
Title of the patch
Security update for upx
Description of the patch
This update for upx to version 3.96 fixes the following issues:
- CVE-2019-1010048: Fixed a denial of service in PackLinuxElf32::PackLinuxElf32help1() (boo#1141777).
- CVE-2019-14296: Fixed a denial of service in canUnpack() (boo#1143839).
- CVE-2019-20021: Fixed a heap-based buffer over-read in canUnpack() (boo#1159833).
- CVE-2019-20053: Fixed a denial of service in canUnpack() (boo#1159920).
- CVE-2018-11243: Fixed a denial of service in PackLinuxElf64::unpack() (boo#1094138).
- Update to version 3.96
* Bug fixes:
[CVE-2019-1010048, boo#1141777]
[CVE-2019-14296, boo#1143839]
[CVE-2019-20021, boo#1159833]
[CVE-2019-20053, boo#1159920]
[CVE-2018-11243 partially - ticket 206 ONLY, boo#1094138]
- Update to version 3.95
* Flag --force-pie when ET_DYN main program is not marked as
DF_1_PIE
* Better compatibility with varying layout of address space on
Linux
* Support for 4 PT_LOAD layout in ELF generated by binutils-2.31
* bug fixes, particularly better diagnosis of malformed input
* bug fixes - see https://github.com/upx/upx/milestone/4
Patchnames
openSUSE-2020-163
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for upx",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for upx to version 3.96 fixes the following issues:\n\n\n- CVE-2019-1010048: Fixed a denial of service in PackLinuxElf32::PackLinuxElf32help1() (boo#1141777).\n- CVE-2019-14296: Fixed a denial of service in canUnpack() (boo#1143839).\n- CVE-2019-20021: Fixed a heap-based buffer over-read in canUnpack() (boo#1159833).\n- CVE-2019-20053: Fixed a denial of service in canUnpack() (boo#1159920).\n- CVE-2018-11243: Fixed a denial of service in PackLinuxElf64::unpack() (boo#1094138).\n\n- Update to version 3.96\n * Bug fixes:\n [CVE-2019-1010048, boo#1141777]\n [CVE-2019-14296, boo#1143839]\n [CVE-2019-20021, boo#1159833]\n [CVE-2019-20053, boo#1159920]\n [CVE-2018-11243 partially - ticket 206 ONLY, boo#1094138]\n- Update to version 3.95\n * Flag --force-pie when ET_DYN main program is not marked as\n DF_1_PIE\n * Better compatibility with varying layout of address space on\n Linux\n * Support for 4 PT_LOAD layout in ELF generated by binutils-2.31\n * bug fixes, particularly better diagnosis of malformed input\n * bug fixes - see https://github.com/upx/upx/milestone/4\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-163",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0163-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:0163-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JFT4W6K4YZYWDA7IJZTH4U4XTFAQHQYY/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:0163-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/JFT4W6K4YZYWDA7IJZTH4U4XTFAQHQYY/"
},
{
"category": "self",
"summary": "SUSE Bug 1094138",
"url": "https://bugzilla.suse.com/1094138"
},
{
"category": "self",
"summary": "SUSE Bug 1141777",
"url": "https://bugzilla.suse.com/1141777"
},
{
"category": "self",
"summary": "SUSE Bug 1143839",
"url": "https://bugzilla.suse.com/1143839"
},
{
"category": "self",
"summary": "SUSE Bug 1159833",
"url": "https://bugzilla.suse.com/1159833"
},
{
"category": "self",
"summary": "SUSE Bug 1159920",
"url": "https://bugzilla.suse.com/1159920"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-11243 page",
"url": "https://www.suse.com/security/cve/CVE-2018-11243/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-1010048 page",
"url": "https://www.suse.com/security/cve/CVE-2019-1010048/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-14296 page",
"url": "https://www.suse.com/security/cve/CVE-2019-14296/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20021 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20021/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20053 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20053/"
}
],
"title": "Security update for upx",
"tracking": {
"current_release_date": "2020-02-04T09:13:50Z",
"generator": {
"date": "2020-02-04T09:13:50Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:0163-1",
"initial_release_date": "2020-02-04T09:13:50Z",
"revision_history": [
{
"date": "2020-02-04T09:13:50Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "upx-3.96-lp151.3.3.1.x86_64",
"product": {
"name": "upx-3.96-lp151.3.3.1.x86_64",
"product_id": "upx-3.96-lp151.3.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 15.1",
"product": {
"name": "openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "upx-3.96-lp151.3.3.1.x86_64 as component of openSUSE Leap 15.1",
"product_id": "openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
},
"product_reference": "upx-3.96-lp151.3.3.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-11243",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-11243"
}
],
"notes": [
{
"category": "general",
"text": "PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a crafted file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-11243",
"url": "https://www.suse.com/security/cve/CVE-2018-11243"
},
{
"category": "external",
"summary": "SUSE Bug 1094138 for CVE-2018-11243",
"url": "https://bugzilla.suse.com/1094138"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-02-04T09:13:50Z",
"details": "important"
}
],
"title": "CVE-2018-11243"
},
{
"cve": "CVE-2019-1010048",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-1010048"
}
],
"notes": [
{
"category": "general",
"text": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-1010048",
"url": "https://www.suse.com/security/cve/CVE-2019-1010048"
},
{
"category": "external",
"summary": "SUSE Bug 1141777 for CVE-2019-1010048",
"url": "https://bugzilla.suse.com/1141777"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-02-04T09:13:50Z",
"details": "moderate"
}
],
"title": "CVE-2019-1010048"
},
{
"cve": "CVE-2019-14296",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-14296"
}
],
"notes": [
{
"category": "general",
"text": "canUnpack in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impact via a crafted UPX packed file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-14296",
"url": "https://www.suse.com/security/cve/CVE-2019-14296"
},
{
"category": "external",
"summary": "SUSE Bug 1143839 for CVE-2019-14296",
"url": "https://bugzilla.suse.com/1143839"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-02-04T09:13:50Z",
"details": "important"
}
],
"title": "CVE-2019-14296"
},
{
"cve": "CVE-2019-20021",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20021"
}
],
"notes": [
{
"category": "general",
"text": "A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20021",
"url": "https://www.suse.com/security/cve/CVE-2019-20021"
},
{
"category": "external",
"summary": "SUSE Bug 1159833 for CVE-2019-20021",
"url": "https://bugzilla.suse.com/1159833"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-02-04T09:13:50Z",
"details": "moderate"
}
],
"title": "CVE-2019-20021"
},
{
"cve": "CVE-2019-20053",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20053"
}
],
"notes": [
{
"category": "general",
"text": "An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20053",
"url": "https://www.suse.com/security/cve/CVE-2019-20053"
},
{
"category": "external",
"summary": "SUSE Bug 1159920 for CVE-2019-20053",
"url": "https://bugzilla.suse.com/1159920"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 15.1:upx-3.96-lp151.3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-02-04T09:13:50Z",
"details": "moderate"
}
],
"title": "CVE-2019-20053"
}
]
}
opensuse-su-2024:11486-1
Vulnerability from csaf_opensuse
Published
2024-06-15 00:00
Modified
2024-06-15 00:00
Summary
upx-3.96-3.2 on GA media
Notes
Title of the patch
upx-3.96-3.2 on GA media
Description of the patch
These are all security issues fixed in the upx-3.96-3.2 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2024-11486
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "upx-3.96-3.2 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the upx-3.96-3.2 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2024-11486",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2024_11486-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2017-16869 page",
"url": "https://www.suse.com/security/cve/CVE-2017-16869/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-11243 page",
"url": "https://www.suse.com/security/cve/CVE-2018-11243/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-1010048 page",
"url": "https://www.suse.com/security/cve/CVE-2019-1010048/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-14296 page",
"url": "https://www.suse.com/security/cve/CVE-2019-14296/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20021 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20021/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20053 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20053/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2020-24119 page",
"url": "https://www.suse.com/security/cve/CVE-2020-24119/"
}
],
"title": "upx-3.96-3.2 on GA media",
"tracking": {
"current_release_date": "2024-06-15T00:00:00Z",
"generator": {
"date": "2024-06-15T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2024:11486-1",
"initial_release_date": "2024-06-15T00:00:00Z",
"revision_history": [
{
"date": "2024-06-15T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "upx-3.96-3.2.aarch64",
"product": {
"name": "upx-3.96-3.2.aarch64",
"product_id": "upx-3.96-3.2.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "upx-3.96-3.2.ppc64le",
"product": {
"name": "upx-3.96-3.2.ppc64le",
"product_id": "upx-3.96-3.2.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "upx-3.96-3.2.s390x",
"product": {
"name": "upx-3.96-3.2.s390x",
"product_id": "upx-3.96-3.2.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "upx-3.96-3.2.x86_64",
"product": {
"name": "upx-3.96-3.2.x86_64",
"product_id": "upx-3.96-3.2.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "upx-3.96-3.2.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:upx-3.96-3.2.aarch64"
},
"product_reference": "upx-3.96-3.2.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "upx-3.96-3.2.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:upx-3.96-3.2.ppc64le"
},
"product_reference": "upx-3.96-3.2.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "upx-3.96-3.2.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:upx-3.96-3.2.s390x"
},
"product_reference": "upx-3.96-3.2.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "upx-3.96-3.2.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
},
"product_reference": "upx-3.96-3.2.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2017-16869",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2017-16869"
}
],
"notes": [
{
"category": "general",
"text": "p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated \"there is no security implication whatsoever.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2017-16869",
"url": "https://www.suse.com/security/cve/CVE-2017-16869"
},
{
"category": "external",
"summary": "SUSE Bug 1068681 for CVE-2017-16869",
"url": "https://bugzilla.suse.com/1068681"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2017-16869"
},
{
"cve": "CVE-2018-11243",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-11243"
}
],
"notes": [
{
"category": "general",
"text": "PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a crafted file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-11243",
"url": "https://www.suse.com/security/cve/CVE-2018-11243"
},
{
"category": "external",
"summary": "SUSE Bug 1094138 for CVE-2018-11243",
"url": "https://bugzilla.suse.com/1094138"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2018-11243"
},
{
"cve": "CVE-2019-1010048",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-1010048"
}
],
"notes": [
{
"category": "general",
"text": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-1010048",
"url": "https://www.suse.com/security/cve/CVE-2019-1010048"
},
{
"category": "external",
"summary": "SUSE Bug 1141777 for CVE-2019-1010048",
"url": "https://bugzilla.suse.com/1141777"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-1010048"
},
{
"cve": "CVE-2019-14296",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-14296"
}
],
"notes": [
{
"category": "general",
"text": "canUnpack in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impact via a crafted UPX packed file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-14296",
"url": "https://www.suse.com/security/cve/CVE-2019-14296"
},
{
"category": "external",
"summary": "SUSE Bug 1143839 for CVE-2019-14296",
"url": "https://bugzilla.suse.com/1143839"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2019-14296"
},
{
"cve": "CVE-2019-20021",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20021"
}
],
"notes": [
{
"category": "general",
"text": "A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20021",
"url": "https://www.suse.com/security/cve/CVE-2019-20021"
},
{
"category": "external",
"summary": "SUSE Bug 1159833 for CVE-2019-20021",
"url": "https://bugzilla.suse.com/1159833"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-20021"
},
{
"cve": "CVE-2019-20053",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20053"
}
],
"notes": [
{
"category": "general",
"text": "An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20053",
"url": "https://www.suse.com/security/cve/CVE-2019-20053"
},
{
"category": "external",
"summary": "SUSE Bug 1159920 for CVE-2019-20053",
"url": "https://bugzilla.suse.com/1159920"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2019-20053"
},
{
"cve": "CVE-2020-24119",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2020-24119"
}
],
"notes": [
{
"category": "general",
"text": "A heap buffer overflow read was discovered in upx 4.0.0, because the check in p_lx_elf.cpp is not perfect.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2020-24119",
"url": "https://www.suse.com/security/cve/CVE-2020-24119"
},
{
"category": "external",
"summary": "SUSE Bug 1186238 for CVE-2020-24119",
"url": "https://bugzilla.suse.com/1186238"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:upx-3.96-3.2.aarch64",
"openSUSE Tumbleweed:upx-3.96-3.2.ppc64le",
"openSUSE Tumbleweed:upx-3.96-3.2.s390x",
"openSUSE Tumbleweed:upx-3.96-3.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2024-06-15T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2020-24119"
}
]
}
opensuse-su-2020:0180-1
Vulnerability from csaf_opensuse
Published
2020-02-06 14:46
Modified
2020-02-06 14:46
Summary
Security update for upx
Notes
Title of the patch
Security update for upx
Description of the patch
This update for upx to version 3.96 fixes the following issues:
- CVE-2019-1010048: Fixed a denial of service in PackLinuxElf32::PackLinuxElf32help1() (boo#1141777).
- CVE-2019-14296: Fixed a denial of service in canUnpack() (boo#1143839).
- CVE-2019-20021: Fixed a heap-based buffer over-read in canUnpack() (boo#1159833).
- CVE-2019-20053: Fixed a denial of service in canUnpack() (boo#1159920).
- CVE-2018-11243: Fixed a denial of service in PackLinuxElf64::unpack() (boo#1094138).
- Update to version 3.96
* Bug fixes:
[CVE-2019-1010048, boo#1141777]
[CVE-2019-14296, boo#1143839]
[CVE-2019-20021, boo#1159833]
[CVE-2019-20053, boo#1159920]
[CVE-2018-11243 partially - ticket 206 ONLY, boo#1094138]
- Update to version 3.95
* Flag --force-pie when ET_DYN main program is not marked as
DF_1_PIE
* Better compatibility with varying layout of address space on
Linux
* Support for 4 PT_LOAD layout in ELF generated by binutils-2.31
* bug fixes, particularly better diagnosis of malformed input
* bug fixes - see https://github.com/upx/upx/milestone/4
This update was imported from the openSUSE:Leap:15.1:Update update project.
Patchnames
openSUSE-2020-180
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for upx",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for upx to version 3.96 fixes the following issues:\n\n\n- CVE-2019-1010048: Fixed a denial of service in PackLinuxElf32::PackLinuxElf32help1() (boo#1141777).\n- CVE-2019-14296: Fixed a denial of service in canUnpack() (boo#1143839).\n- CVE-2019-20021: Fixed a heap-based buffer over-read in canUnpack() (boo#1159833).\n- CVE-2019-20053: Fixed a denial of service in canUnpack() (boo#1159920).\n- CVE-2018-11243: Fixed a denial of service in PackLinuxElf64::unpack() (boo#1094138).\n\n- Update to version 3.96\n * Bug fixes:\n [CVE-2019-1010048, boo#1141777]\n [CVE-2019-14296, boo#1143839]\n [CVE-2019-20021, boo#1159833]\n [CVE-2019-20053, boo#1159920]\n [CVE-2018-11243 partially - ticket 206 ONLY, boo#1094138]\n- Update to version 3.95\n * Flag --force-pie when ET_DYN main program is not marked as\n DF_1_PIE\n * Better compatibility with varying layout of address space on\n Linux\n * Support for 4 PT_LOAD layout in ELF generated by binutils-2.31\n * bug fixes, particularly better diagnosis of malformed input\n * bug fixes - see https://github.com/upx/upx/milestone/4\n\nThis update was imported from the openSUSE:Leap:15.1:Update update project.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-2020-180",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_0180-1.json"
},
{
"category": "self",
"summary": "URL for openSUSE-SU-2020:0180-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PCHFXHDFQGPZW5PCPH6CZNEYQDQLG3GR/"
},
{
"category": "self",
"summary": "E-Mail link for openSUSE-SU-2020:0180-1",
"url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PCHFXHDFQGPZW5PCPH6CZNEYQDQLG3GR/"
},
{
"category": "self",
"summary": "SUSE Bug 1094138",
"url": "https://bugzilla.suse.com/1094138"
},
{
"category": "self",
"summary": "SUSE Bug 1141777",
"url": "https://bugzilla.suse.com/1141777"
},
{
"category": "self",
"summary": "SUSE Bug 1143839",
"url": "https://bugzilla.suse.com/1143839"
},
{
"category": "self",
"summary": "SUSE Bug 1159833",
"url": "https://bugzilla.suse.com/1159833"
},
{
"category": "self",
"summary": "SUSE Bug 1159920",
"url": "https://bugzilla.suse.com/1159920"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2018-11243 page",
"url": "https://www.suse.com/security/cve/CVE-2018-11243/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-1010048 page",
"url": "https://www.suse.com/security/cve/CVE-2019-1010048/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-14296 page",
"url": "https://www.suse.com/security/cve/CVE-2019-14296/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20021 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20021/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2019-20053 page",
"url": "https://www.suse.com/security/cve/CVE-2019-20053/"
}
],
"title": "Security update for upx",
"tracking": {
"current_release_date": "2020-02-06T14:46:47Z",
"generator": {
"date": "2020-02-06T14:46:47Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2020:0180-1",
"initial_release_date": "2020-02-06T14:46:47Z",
"revision_history": [
{
"date": "2020-02-06T14:46:47Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "upx-3.96-bp151.4.3.1.aarch64",
"product": {
"name": "upx-3.96-bp151.4.3.1.aarch64",
"product_id": "upx-3.96-bp151.4.3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "upx-3.96-bp151.4.3.1.ppc64le",
"product": {
"name": "upx-3.96-bp151.4.3.1.ppc64le",
"product_id": "upx-3.96-bp151.4.3.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "upx-3.96-bp151.4.3.1.s390x",
"product": {
"name": "upx-3.96-bp151.4.3.1.s390x",
"product_id": "upx-3.96-bp151.4.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "upx-3.96-bp151.4.3.1.x86_64",
"product": {
"name": "upx-3.96-bp151.4.3.1.x86_64",
"product_id": "upx-3.96-bp151.4.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Package Hub 15 SP1",
"product": {
"name": "SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "upx-3.96-bp151.4.3.1.aarch64 as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64"
},
"product_reference": "upx-3.96-bp151.4.3.1.aarch64",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "upx-3.96-bp151.4.3.1.ppc64le as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le"
},
"product_reference": "upx-3.96-bp151.4.3.1.ppc64le",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "upx-3.96-bp151.4.3.1.s390x as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x"
},
"product_reference": "upx-3.96-bp151.4.3.1.s390x",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "upx-3.96-bp151.4.3.1.x86_64 as component of SUSE Package Hub 15 SP1",
"product_id": "SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
},
"product_reference": "upx-3.96-bp151.4.3.1.x86_64",
"relates_to_product_reference": "SUSE Package Hub 15 SP1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2018-11243",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2018-11243"
}
],
"notes": [
{
"category": "general",
"text": "PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a crafted file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2018-11243",
"url": "https://www.suse.com/security/cve/CVE-2018-11243"
},
{
"category": "external",
"summary": "SUSE Bug 1094138 for CVE-2018-11243",
"url": "https://bugzilla.suse.com/1094138"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-02-06T14:46:47Z",
"details": "important"
}
],
"title": "CVE-2018-11243"
},
{
"cve": "CVE-2019-1010048",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-1010048"
}
],
"notes": [
{
"category": "general",
"text": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-1010048",
"url": "https://www.suse.com/security/cve/CVE-2019-1010048"
},
{
"category": "external",
"summary": "SUSE Bug 1141777 for CVE-2019-1010048",
"url": "https://bugzilla.suse.com/1141777"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.0"
},
"products": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-02-06T14:46:47Z",
"details": "moderate"
}
],
"title": "CVE-2019-1010048"
},
{
"cve": "CVE-2019-14296",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-14296"
}
],
"notes": [
{
"category": "general",
"text": "canUnpack in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (SEGV or buffer overflow, and application crash) or possibly have unspecified other impact via a crafted UPX packed file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-14296",
"url": "https://www.suse.com/security/cve/CVE-2019-14296"
},
{
"category": "external",
"summary": "SUSE Bug 1143839 for CVE-2019-14296",
"url": "https://bugzilla.suse.com/1143839"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"products": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-02-06T14:46:47Z",
"details": "important"
}
],
"title": "CVE-2019-14296"
},
{
"cve": "CVE-2019-20021",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20021"
}
],
"notes": [
{
"category": "general",
"text": "A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20021",
"url": "https://www.suse.com/security/cve/CVE-2019-20021"
},
{
"category": "external",
"summary": "SUSE Bug 1159833 for CVE-2019-20021",
"url": "https://bugzilla.suse.com/1159833"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-02-06T14:46:47Z",
"details": "moderate"
}
],
"title": "CVE-2019-20021"
},
{
"cve": "CVE-2019-20053",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2019-20053"
}
],
"notes": [
{
"category": "general",
"text": "An invalid memory address dereference was discovered in the canUnpack function in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2019-20053",
"url": "https://www.suse.com/security/cve/CVE-2019-20053"
},
{
"category": "external",
"summary": "SUSE Bug 1159920 for CVE-2019-20053",
"url": "https://bugzilla.suse.com/1159920"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.aarch64",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.ppc64le",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.s390x",
"SUSE Package Hub 15 SP1:upx-3.96-bp151.4.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2020-02-06T14:46:47Z",
"details": "moderate"
}
],
"title": "CVE-2019-20053"
}
]
}
gsd-2019-1010048
Vulnerability from gsd
Modified
2023-12-13 01:23
Details
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2019-1010048",
"description": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.",
"id": "GSD-2019-1010048",
"references": [
"https://www.suse.com/security/cve/CVE-2019-1010048.html",
"https://advisories.mageia.org/CVE-2019-1010048.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2019-1010048"
],
"details": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.",
"id": "GSD-2019-1010048",
"modified": "2023-12-13T01:23:50.637557Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2019-1010048",
"STATE": "REJECT"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none."
}
]
}
}
}
}
ghsa-95jc-qh52-4mv6
Vulnerability from github
Published
2022-05-24 16:50
Modified
2022-05-24 16:50
VLAI Severity ?
Details
UPX 3.95 is affected by: Integer Overflow. The impact is: attacker can cause a denial of service. The component is: src/p_lx_elf.cpp PackLinuxElf32::PackLinuxElf32help1() Line 262. The attack vector is: the victim must open a specially crafted ELF file.
{
"affected": [],
"aliases": [
"CVE-2019-1010048"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-16T14:15:00Z",
"severity": null
},
"details": "UPX 3.95 is affected by: Integer Overflow. The impact is: attacker can cause a denial of service. The component is: src/p_lx_elf.cpp PackLinuxElf32::PackLinuxElf32help1() Line 262. The attack vector is: the victim must open a specially crafted ELF file.",
"id": "GHSA-95jc-qh52-4mv6",
"modified": "2022-05-24T16:50:26Z",
"published": "2022-05-24T16:50:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010048"
},
{
"type": "WEB",
"url": "https://github.com/upx/upx/pull/190"
}
],
"schema_version": "1.4.0",
"severity": []
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…