CVE-2021-30501 — Improper Input Validation in Upx-ucl

CWE-20 — Improper Input ValidationCWE-617 — Reachable Assertion4 documents4 sources
Severity
5.5MEDIUMNVD
EPSS
0.4%
top 42.51%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Debian Upx-uclUPXFedoraproject Fedora+1 more
Timeline
PublishedMay 27
Latest updateMay 24

Description

An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UPX 4.0.0. The flow allows attackers to cause a denial of service (abort) via a crafted file.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/upx-ucl< upx-ucl 4.2.2-1 (forky)
▶CVEListV5upx/upxupx 4.0
▶NVDupx/upx4.0.0

Also affects: Fedora 33, Enterprise Linux 7.0

Patches

Patch: bugzilla.redhat.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-88gh-wqj4-3fxr: An assertion abort was found in upx MemBuffer::alloc() in mem↗2022-05-24
▶
OSV
CVE-2021-30501: An assertion abort was found in upx MemBuffer::alloc() in mem↗2021-05-27
▶

📋Vendor Advisories

1
Debian
CVE-2021-30501: upx-ucl - An assertion abort was found in upx MemBuffer::alloc() in mem.cpp, in version UP...↗2021
▶
CVE-2021-30501 — Improper Input Validation in Upx-ucl | cvebase