openSUSE-SU-2020:0163-1

Dashboard / Vulnerabilities / openSUSE-SU-2020:0163-1

openSUSE-SU-2020:0163-1

Summary: Security update for upx

Details: This update for upx to version 3.96 fixes the following issues: - CVE-2019-1010048: Fixed a denial of service in PackLinuxElf32::PackLinuxElf32help1() (boo#1141777). - CVE-2019-14296: Fixed a denial of service in canUnpack() (boo#1143839). - CVE-2019-20021: Fixed a heap-based buffer over-read in canUnpack() (boo#1159833). - CVE-2019-20053: Fixed a denial of service in canUnpack() (boo#1159920). - CVE-2018-11243: Fixed a denial of service in PackLinuxElf64::unpack() (boo#1094138). - Update to version 3.96 * Bug fixes: [CVE-2019-1010048, boo#1141777] [CVE-2019-14296, boo#1143839] [CVE-2019-20021, boo#1159833] [CVE-2019-20053, boo#1159920] [CVE-2018-11243 partially - ticket 206 ONLY, boo#1094138] - Update to version 3.95 * Flag --force-pie when ET_DYN main program is not marked as DF_1_PIE * Better compatibility with varying layout of address space on Linux * Support for 4 PT_LOAD layout in ELF generated by binutils-2.31 * bug fixes, particularly better diagnosis of malformed input * bug fixes - see https://github.com/upx/upx/milestone/4

References: https://lists.opensuse.org/archives/list/[email protected]/thread/JFT4W6K4YZYWDA7IJZTH4U4XTFAQHQYY/, https://bugzilla.suse.com/1094138, https://bugzilla.suse.com/1141777, https://bugzilla.suse.com/1143839, https://bugzilla.suse.com/1159833, https://bugzilla.suse.com/1159920, https://www.suse.com/security/cve/CVE-2018-11243, https://www.suse.com/security/cve/CVE-2019-1010048, https://www.suse.com/security/cve/CVE-2019-14296, https://www.suse.com/security/cve/CVE-2019-20021, https://www.suse.com/security/cve/CVE-2019-20053