SUSE 5053 Published by

An upx security update has been released for SUSE Linux Enterprise 15 SP4.

openSUSE-SU-2023:0088-1: important: Security update for upx

openSUSE Security Update: Security update for upx

Announcement ID: openSUSE-SU-2023:0088-1
Rating: important
References: #1183510 #1184701 #1184702 #1207121 #1207122
#1209765 #1209766 #1209767 #1209768 #1209769
#1209770 #1209771
Cross-References: CVE-2021-20285 CVE-2021-30500 CVE-2021-30501
CVE-2021-43311 CVE-2021-43312 CVE-2021-43313
CVE-2021-43314 CVE-2021-43315 CVE-2021-43316
CVE-2021-43317 CVE-2023-23456 CVE-2023-23457

CVSS scores:
CVE-2021-20285 (NVD) : 6.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
CVE-2021-30500 (NVD) : 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2021-30501 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2021-43311 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-43312 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-43313 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-43314 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-43315 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-43316 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2021-43317 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2023-23456 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2023-23457 (NVD) : 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Affected Products:
openSUSE Backports SLE-15-SP4

An update that fixes 12 vulnerabilities is now available.


upx was updated to fix the following issues:

Update to release 4.0.2

* Fix unpack of ELF x86-64 that failed with "CantUnpackException: corrupt
* Resolve SEGV on PackLinuxElf64::invert_pt_dynamic

- CVE-2021-30500: Fixed Null pointer dereference in
PackLinuxElf:canUnpack() in p_lx_elf.cpp
- CVE-2021-30501: Fixed Assertion abort in function MemBuffer:alloc()
- CVE-2021-43311: Fixed Heap-based buffer overflow in
PackLinuxElf32:elf_lookup() at p_lx_elf.cpp
- CVE-2021-43312: Fixed Heap-based buffer overflow in
PackLinuxElf64:invert_pt_dynamic at p_lx_elf.cpp:5239
- CVE-2021-43313: Fixed Heap-based buffer overflow in
PackLinuxElf32:invert_pt_dynamic at p_lx_elf.cpp:1688
- CVE-2021-43314: Fixed Heap-based buffer overflows in
PackLinuxElf32:elf_lookup() at p_lx_elf.cp
- CVE-2021-43315: Fixed Heap-based buffer overflows in
PackLinuxElf32:elf_lookup() at p_lx_elf.cp
- CVE-2021-43316: Fixed Heap-based buffer overflow in func get_le64()
- CVE-2021-43317: Fixed Heap-based buffer overflows in
PackLinuxElf64:elf_lookup() at p_lx_elf.cp
- CVE-2023-23456: Fixed heap-buffer-overflow in PackTmt:pack()
- CVE-2023-23457: Fixed SEGV on PackLinuxElf64:invert_pt_dynamic() in

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Backports SLE-15-SP4:

zypper in -t patch openSUSE-2023-88=1

Package List:

- openSUSE Backports SLE-15-SP4 (aarch64 ppc64le s390x x86_64):