Every CVE Search/ Get API key

CVE-2017-16869

** DISPUTED ** p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service ...

7.8 HighFix availableDisputed

p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.05%Up 0.4 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 7.8

p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever.

Record
CVE-2017-16869
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever.

Record
CVE-2017-16869
Updated
2026-11-02
EUVDEUVD-2017-8043 No score

p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever.

Record
EUVD-2017-8043
Updated
2026-11-03
GitHub AdvisoriesGHSA-3j3j-cj56-29p8 7.8

** DISPUTED ** p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service ...

** DISPUTED ** p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever."

Record
GHSA-3j3j-cj56-29p8
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVBELL-CVE-2017-16869 7.8

CVE-2017-16869 does not affect BellSoft software

Record
BELL-CVE-2017-16869
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever.

Record
CVE-2017-16869
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-16869 7.8

p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever.

Record
DEBIAN-CVE-2017-16869
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2017-16869 7.8

** DISPUTED ** p_mach.cpp in UPX 3.94 allows remote attackers to cause a denial of service (invalid memory access and application crash) or possibly have unspecified other impact via a crafted Mach-O file, related to canPack and unpack functions. NOTE: the vendor has stated "there is no security implication whatsoever."

Record
UBUNTU-CVE-2017-16869
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVopenSUSE-SU-2024:11486-1 No score

upx-3.96-3.2 on GA media

These are all security issues fixed in the upx-3.96-3.2 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11486-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
upx-ucl
Debian:13
 before 3.94-4
3.94-4
upx-ucl
Debian:14
 before 3.94-4
3.94-4
upx
openSUSE:Tumbleweed
From an advisory covering 7 CVEs
 before 3.96-3.2
3.96-3.2

History

History
RecordedChangedSources
affected, facts
affected
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-16869 is a high vulnerability (CVSS 7.8) in Upx, published November 17, 2017. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.05%, the 64th percentile. Fixed in upx-ucl 3.94-4.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open