Updated upx packages fix security vulnerability
Publication date: 20 Feb 2023Modification date: 20 Feb 2023
Type: security
Affected Mageia releases : 8
CVE: CVE-2023-23456 , CVE-2023-23457
Description
Denial of service due to heap-based buffer overflow issue in UPX in
PackTmt::pack() in p_tmt.cpp file. (CVE-2023-23456)
Denial of service due to segmentation fault in UPX in
PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. (CVE-2023-23457)
References
- https://bugs.mageia.org/show_bug.cgi?id=31449
- https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OY3PZTUNJBOAOSBB3625O5WLS7HRY73I/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TGEP3FBNRZXGLIA2B2ICMB32JVMPREFZ/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23456
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23457
SRPMS
8/core
- upx-4.0.2-1.mga8