GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2023:0088-1

Vulnerability from csaf_opensuse - Published: 2023-04-11 07:07 - Updated: 2023-04-11 07:07
Summary
Security update for upx
Severity
Important
Notes
Title of the patch: Security update for upx
Description of the patch: upx was updated to fix the following issues: Update to release 4.0.2 * Fix unpack of ELF x86-64 that failed with 'CantUnpackException: corrupt b_info' * Resolve SEGV on PackLinuxElf64::invert_pt_dynamic - CVE-2021-30500: Fixed Null pointer dereference in PackLinuxElf:canUnpack() in p_lx_elf.cpp - CVE-2021-30501: Fixed Assertion abort in function MemBuffer:alloc() - CVE-2021-43311: Fixed Heap-based buffer overflow in PackLinuxElf32:elf_lookup() at p_lx_elf.cpp - CVE-2021-43312: Fixed Heap-based buffer overflow in PackLinuxElf64:invert_pt_dynamic at p_lx_elf.cpp:5239 - CVE-2021-43313: Fixed Heap-based buffer overflow in PackLinuxElf32:invert_pt_dynamic at p_lx_elf.cpp:1688 - CVE-2021-43314: Fixed Heap-based buffer overflows in PackLinuxElf32:elf_lookup() at p_lx_elf.cp - CVE-2021-43315: Fixed Heap-based buffer overflows in PackLinuxElf32:elf_lookup() at p_lx_elf.cp - CVE-2021-43316: Fixed Heap-based buffer overflow in func get_le64() - CVE-2021-43317: Fixed Heap-based buffer overflows in PackLinuxElf64:elf_lookup() at p_lx_elf.cp - CVE-2023-23456: Fixed heap-buffer-overflow in PackTmt:pack() - CVE-2023-23457: Fixed SEGV on PackLinuxElf64:invert_pt_dynamic() in p_lx_elf.cpp
Patchnames: openSUSE-2023-88
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2021-20285
6.6 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64 —
Vendor Fix
Unresolved product id: SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le —
Vendor Fix
Unresolved product id: SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x —
Vendor Fix
Unresolved product id: SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2021-30500
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Recommended 8 products, the same list as for CVE-2021-20285
Threats
Impact important
CVE-2021-30501
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2021-20285
Threats
Impact moderate
CVE-2021-43311
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2021-20285
Threats
Impact important
CVE-2021-43312
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2021-20285
Threats
Impact important
CVE-2021-43313
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2021-20285
Threats
Impact important
CVE-2021-43314
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2021-20285
Threats
Impact important
CVE-2021-43315
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2021-20285
Threats
Impact important
CVE-2021-43316
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2021-20285
Threats
Impact important
CVE-2021-43317
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2021-20285
Threats
Impact important
CVE-2023-23456
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2021-20285
Threats
Impact moderate
CVE-2023-23457
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Affected products
Recommended 8 products, the same list as for CVE-2021-20285
Threats
Impact moderate
References
URL Category
https://www.suse.com/support/security/rating/ external
https://ftp.suse.com/pub/projects/security/csaf/o… self
https://lists.opensuse.org/archives/list/security… self
https://lists.opensuse.org/archives/list/security… self
https://bugzilla.suse.com/1183510 self
https://bugzilla.suse.com/1184701 self
https://bugzilla.suse.com/1184702 self
https://bugzilla.suse.com/1207121 self
https://bugzilla.suse.com/1207122 self
https://bugzilla.suse.com/1209765 self
https://bugzilla.suse.com/1209766 self
https://bugzilla.suse.com/1209767 self
https://bugzilla.suse.com/1209768 self
https://bugzilla.suse.com/1209769 self
https://bugzilla.suse.com/1209770 self
https://bugzilla.suse.com/1209771 self
https://www.suse.com/security/cve/CVE-2021-20285/ self
https://www.suse.com/security/cve/CVE-2021-30500/ self
https://www.suse.com/security/cve/CVE-2021-30501/ self
https://www.suse.com/security/cve/CVE-2021-43311/ self
https://www.suse.com/security/cve/CVE-2021-43312/ self
https://www.suse.com/security/cve/CVE-2021-43313/ self
https://www.suse.com/security/cve/CVE-2021-43314/ self
https://www.suse.com/security/cve/CVE-2021-43315/ self
https://www.suse.com/security/cve/CVE-2021-43316/ self
https://www.suse.com/security/cve/CVE-2021-43317/ self
https://www.suse.com/security/cve/CVE-2023-23456/ self
https://www.suse.com/security/cve/CVE-2023-23457/ self
https://www.suse.com/security/cve/CVE-2021-20285 external
https://bugzilla.suse.com/1183510 external
https://www.suse.com/security/cve/CVE-2021-30500 external
https://bugzilla.suse.com/1184702 external
https://www.suse.com/security/cve/CVE-2021-30501 external
https://bugzilla.suse.com/1184701 external
https://www.suse.com/security/cve/CVE-2021-43311 external
https://bugzilla.suse.com/1209765 external
https://www.suse.com/security/cve/CVE-2021-43312 external
https://bugzilla.suse.com/1209766 external
https://www.suse.com/security/cve/CVE-2021-43313 external
https://bugzilla.suse.com/1209767 external
https://www.suse.com/security/cve/CVE-2021-43314 external
https://bugzilla.suse.com/1209768 external
https://www.suse.com/security/cve/CVE-2021-43315 external
https://bugzilla.suse.com/1209769 external
https://www.suse.com/security/cve/CVE-2021-43316 external
https://bugzilla.suse.com/1209770 external
https://www.suse.com/security/cve/CVE-2021-43317 external
https://bugzilla.suse.com/1209771 external
https://www.suse.com/security/cve/CVE-2023-23456 external
https://bugzilla.suse.com/1207121 external
https://www.suse.com/security/cve/CVE-2023-23457 external
https://bugzilla.suse.com/1207122 external
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for upx",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "\nupx was updated to fix the following issues:\n\nUpdate to release 4.0.2\n\n* Fix unpack of ELF x86-64 that failed with \u0027CantUnpackException: corrupt b_info\u0027\n* Resolve SEGV on PackLinuxElf64::invert_pt_dynamic\n\n- CVE-2021-30500: Fixed Null pointer dereference in PackLinuxElf:canUnpack() in p_lx_elf.cpp\n- CVE-2021-30501: Fixed Assertion abort in function MemBuffer:alloc()\n- CVE-2021-43311: Fixed Heap-based buffer overflow in PackLinuxElf32:elf_lookup() at p_lx_elf.cpp\n- CVE-2021-43312: Fixed Heap-based buffer overflow in PackLinuxElf64:invert_pt_dynamic at p_lx_elf.cpp:5239\n- CVE-2021-43313: Fixed Heap-based buffer overflow in PackLinuxElf32:invert_pt_dynamic at p_lx_elf.cpp:1688\n- CVE-2021-43314: Fixed Heap-based buffer overflows in PackLinuxElf32:elf_lookup() at p_lx_elf.cp\n- CVE-2021-43315: Fixed Heap-based buffer overflows in PackLinuxElf32:elf_lookup() at p_lx_elf.cp\n- CVE-2021-43316: Fixed Heap-based buffer overflow in func get_le64()\n- CVE-2021-43317: Fixed Heap-based buffer overflows in PackLinuxElf64:elf_lookup() at p_lx_elf.cp\n- CVE-2023-23456: Fixed heap-buffer-overflow in PackTmt:pack()\n- CVE-2023-23457: Fixed SEGV on PackLinuxElf64:invert_pt_dynamic() in p_lx_elf.cpp\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2023-88",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2023_0088-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2023:0088-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XLSYENIWX7YMHJJKVRBH2CPDXM5X3IW6/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2023:0088-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XLSYENIWX7YMHJJKVRBH2CPDXM5X3IW6/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1183510",
        "url": "https://bugzilla.suse.com/1183510"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1184701",
        "url": "https://bugzilla.suse.com/1184701"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1184702",
        "url": "https://bugzilla.suse.com/1184702"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1207121",
        "url": "https://bugzilla.suse.com/1207121"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1207122",
        "url": "https://bugzilla.suse.com/1207122"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209765",
        "url": "https://bugzilla.suse.com/1209765"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209766",
        "url": "https://bugzilla.suse.com/1209766"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209767",
        "url": "https://bugzilla.suse.com/1209767"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209768",
        "url": "https://bugzilla.suse.com/1209768"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209769",
        "url": "https://bugzilla.suse.com/1209769"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209770",
        "url": "https://bugzilla.suse.com/1209770"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1209771",
        "url": "https://bugzilla.suse.com/1209771"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-20285 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-20285/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-30500 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-30500/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-30501 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-30501/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-43311 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-43311/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-43312 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-43312/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-43313 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-43313/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-43314 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-43314/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-43315 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-43315/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-43316 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-43316/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2021-43317 page",
        "url": "https://www.suse.com/security/cve/CVE-2021-43317/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-23456 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-23456/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2023-23457 page",
        "url": "https://www.suse.com/security/cve/CVE-2023-23457/"
      }
    ],
    "title": "Security update for upx",
    "tracking": {
      "current_release_date": "2023-04-11T07:07:29Z",
      "generator": {
        "date": "2023-04-11T07:07:29Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2023:0088-1",
      "initial_release_date": "2023-04-11T07:07:29Z",
      "revision_history": [
        {
          "date": "2023-04-11T07:07:29Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "upx-4.0.2-bp154.4.6.1.aarch64",
                "product": {
                  "name": "upx-4.0.2-bp154.4.6.1.aarch64",
                  "product_id": "upx-4.0.2-bp154.4.6.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "upx-4.0.2-bp154.4.6.1.ppc64le",
                "product": {
                  "name": "upx-4.0.2-bp154.4.6.1.ppc64le",
                  "product_id": "upx-4.0.2-bp154.4.6.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "upx-4.0.2-bp154.4.6.1.s390x",
                "product": {
                  "name": "upx-4.0.2-bp154.4.6.1.s390x",
                  "product_id": "upx-4.0.2-bp154.4.6.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "upx-4.0.2-bp154.4.6.1.x86_64",
                "product": {
                  "name": "upx-4.0.2-bp154.4.6.1.x86_64",
                  "product_id": "upx-4.0.2-bp154.4.6.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Package Hub 15 SP4",
                "product": {
                  "name": "SUSE Package Hub 15 SP4",
                  "product_id": "SUSE Package Hub 15 SP4"
                }
              },
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.4",
                "product": {
                  "name": "openSUSE Leap 15.4",
                  "product_id": "openSUSE Leap 15.4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.4"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "upx-4.0.2-bp154.4.6.1.aarch64 as component of SUSE Package Hub 15 SP4",
          "product_id": "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64"
        },
        "product_reference": "upx-4.0.2-bp154.4.6.1.aarch64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "upx-4.0.2-bp154.4.6.1.ppc64le as component of SUSE Package Hub 15 SP4",
          "product_id": "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le"
        },
        "product_reference": "upx-4.0.2-bp154.4.6.1.ppc64le",
        "relates_to_product_reference": "SUSE Package Hub 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "upx-4.0.2-bp154.4.6.1.s390x as component of SUSE Package Hub 15 SP4",
          "product_id": "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x"
        },
        "product_reference": "upx-4.0.2-bp154.4.6.1.s390x",
        "relates_to_product_reference": "SUSE Package Hub 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "upx-4.0.2-bp154.4.6.1.x86_64 as component of SUSE Package Hub 15 SP4",
          "product_id": "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64"
        },
        "product_reference": "upx-4.0.2-bp154.4.6.1.x86_64",
        "relates_to_product_reference": "SUSE Package Hub 15 SP4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "upx-4.0.2-bp154.4.6.1.aarch64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64"
        },
        "product_reference": "upx-4.0.2-bp154.4.6.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "upx-4.0.2-bp154.4.6.1.ppc64le as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le"
        },
        "product_reference": "upx-4.0.2-bp154.4.6.1.ppc64le",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "upx-4.0.2-bp154.4.6.1.s390x as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x"
        },
        "product_reference": "upx-4.0.2-bp154.4.6.1.s390x",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "upx-4.0.2-bp154.4.6.1.x86_64 as component of openSUSE Leap 15.4",
          "product_id": "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        },
        "product_reference": "upx-4.0.2-bp154.4.6.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-20285",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-20285"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in upx canPack in p_lx_elf.cpp in UPX 3.96. This flaw allows attackers to cause a denial of service (SEGV or buffer overflow and application crash) or possibly have unspecified other impacts via a crafted ELF. The highest threat from this vulnerability is to system availability.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-20285",
          "url": "https://www.suse.com/security/cve/CVE-2021-20285"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1183510 for CVE-2021-20285",
          "url": "https://bugzilla.suse.com/1183510"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-20285"
    },
    {
      "cve": "CVE-2021-30500",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-30500"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Null pointer dereference was found in upx PackLinuxElf::canUnpack() in p_lx_elf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-30500",
          "url": "https://www.suse.com/security/cve/CVE-2021-30500"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1184702 for CVE-2021-30500",
          "url": "https://bugzilla.suse.com/1184702"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-30500"
    },
    {
      "cve": "CVE-2021-30501",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-30501"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-30501",
          "url": "https://www.suse.com/security/cve/CVE-2021-30501"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1184701 for CVE-2021-30501",
          "url": "https://bugzilla.suse.com/1184701"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2021-30501"
    },
    {
      "cve": "CVE-2021-43311",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-43311"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflow was discovered in upx, during the generic pointer \u0027p\u0027 points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5382.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-43311",
          "url": "https://www.suse.com/security/cve/CVE-2021-43311"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209765 for CVE-2021-43311",
          "url": "https://bugzilla.suse.com/1209765"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-43311"
    },
    {
      "cve": "CVE-2021-43312",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-43312"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflow was discovered in upx, during the variable \u0027bucket\u0027 points to an inaccessible address. The issue is being triggered in the function PackLinuxElf64::invert_pt_dynamic at p_lx_elf.cpp:5239.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-43312",
          "url": "https://www.suse.com/security/cve/CVE-2021-43312"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209766 for CVE-2021-43312",
          "url": "https://bugzilla.suse.com/1209766"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-43312"
    },
    {
      "cve": "CVE-2021-43313",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-43313"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflow was discovered in upx, during the variable \u0027bucket\u0027 points to an inaccessible address. The issue is being triggered in the function PackLinuxElf32::invert_pt_dynamic at p_lx_elf.cpp:1688.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-43313",
          "url": "https://www.suse.com/security/cve/CVE-2021-43313"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209767 for CVE-2021-43313",
          "url": "https://bugzilla.suse.com/1209767"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-43313"
    },
    {
      "cve": "CVE-2021-43314",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-43314"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflows was discovered in upx, during the generic pointer \u0027p\u0027 points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5368",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-43314",
          "url": "https://www.suse.com/security/cve/CVE-2021-43314"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209768 for CVE-2021-43314",
          "url": "https://bugzilla.suse.com/1209768"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-43314"
    },
    {
      "cve": "CVE-2021-43315",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-43315"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflows was discovered in upx, during the generic pointer \u0027p\u0027 points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf32::elf_lookup() at p_lx_elf.cpp:5349",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-43315",
          "url": "https://www.suse.com/security/cve/CVE-2021-43315"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209769 for CVE-2021-43315",
          "url": "https://bugzilla.suse.com/1209769"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-43315"
    },
    {
      "cve": "CVE-2021-43316",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-43316"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflow was discovered in upx, during the generic pointer \u0027p\u0027 points to an inaccessible address in func get_le64().",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-43316",
          "url": "https://www.suse.com/security/cve/CVE-2021-43316"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209770 for CVE-2021-43316",
          "url": "https://bugzilla.suse.com/1209770"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-43316"
    },
    {
      "cve": "CVE-2021-43317",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2021-43317"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflows was discovered in upx, during the generic pointer \u0027p\u0027 points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf64::elf_lookup() at p_lx_elf.cpp:5404",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2021-43317",
          "url": "https://www.suse.com/security/cve/CVE-2021-43317"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1209771 for CVE-2021-43317",
          "url": "https://bugzilla.suse.com/1209771"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "important"
        }
      ],
      "title": "CVE-2021-43317"
    },
    {
      "cve": "CVE-2023-23456",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-23456"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-23456",
          "url": "https://www.suse.com/security/cve/CVE-2023-23456"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207121 for CVE-2023-23456",
          "url": "https://bugzilla.suse.com/1207121"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-23456"
    },
    {
      "cve": "CVE-2023-23457",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2023-23457"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access that could lead to a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
          "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
          "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2023-23457",
          "url": "https://www.suse.com/security/cve/CVE-2023-23457"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1207122 for CVE-2023-23457",
          "url": "https://bugzilla.suse.com/1207122"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.aarch64",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.s390x",
            "SUSE Package Hub 15 SP4:upx-4.0.2-bp154.4.6.1.x86_64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.aarch64",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.ppc64le",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.s390x",
            "openSUSE Leap 15.4:upx-4.0.2-bp154.4.6.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2023-04-11T07:07:29Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2023-23457"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.