{"id":"CVE-2023-23456","aliases":["ALPINE-CVE-2023-23456","BELL-CVE-2023-23456","DEBIAN-CVE-2023-23456","DLA-3991-1","EUVD-2023-27556","GHSA-3j7g-922g-j6r3","MGASA-2023-0052","UBUNTU-CVE-2023-23456","openSUSE-SU-2023:0088-1"],"status":"published","title":"Upx: heap-buffer-overflow in packtmt::pack()","description":"A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00398,"percentile":0.34325,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2023-01-12T00:00:00Z","modified":"2026-11-03T06:32:58Z","fixes":[{"ecosystem":"Alpine:v3.17","package":"upx","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"upx","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"upx","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"upx","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"upx","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"upx","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"upx","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"upx","fixed_in":["4.0.2-r0"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"upx-ucl","fixed_in":["4.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"upx-ucl","fixed_in":["4.2.2-1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"upx-ucl","fixed_in":["3.96-2+deb11u1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.17","package":"upx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"upx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"upx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"upx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"upx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"upx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"upx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"upx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-r0"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"upx-ucl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"upx-ucl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"upx-ucl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.96-2+deb11u1"}]}],"versions":["3.96-2"]},{"source":"osv","ecosystem":"Mageia:8","package":"upx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"upx-ucl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.96-3","4.2.2-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"upx-ucl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.4-1","4.2.4-1.1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"upx-ucl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.4-1.1build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"upx-ucl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.2.4-1.1","4.2.4-1.1build1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"upx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-bp154.4.6.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"upx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.2-bp154.4.6.1"}]}],"bundled":12}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"upx","product":"upx"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2160381","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/upx/upx/commit/510505a85cbe45e51fbd470f1aa8b02157c429d4","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/upx/upx/issues/632","tags":["x_transferred","Exploit","Third Party Advisory","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EL3BVKIGG3SH6I3KPOYQAWCBD4UMPOPI/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGEP3FBNRZXGLIA2B2ICMB32JVMPREFZ/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00013.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-23456","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EL3BVKIGG3SH6I3KPOYQAWCBD4UMPOPI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TGEP3FBNRZXGLIA2B2ICMB32JVMPREFZ"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/EL3BVKIGG3SH6I3KPOYQAWCBD4UMPOPI"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TGEP3FBNRZXGLIA2B2ICMB32JVMPREFZ"},{"url":"https://github.com/advisories/GHSA-3j7g-922g-j6r3"},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-23456","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-23456","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/23xxx/CVE-2023-23456.json","tags":["advisory"]},{"url":"https://github.com/upx/upx","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-23456","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0052.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31449","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OY3PZTUNJBOAOSBB3625O5WLS7HRY73I/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/TGEP3FBNRZXGLIA2B2ICMB32JVMPREFZ/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-23456","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-23456","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XLSYENIWX7YMHJJKVRBH2CPDXM5X3IW6/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183510","tags":["report"]},{"url":"https://bugzilla.suse.com/1184701","tags":["report"]},{"url":"https://bugzilla.suse.com/1184702","tags":["report"]},{"url":"https://bugzilla.suse.com/1207121","tags":["report"]},{"url":"https://bugzilla.suse.com/1207122","tags":["report"]},{"url":"https://bugzilla.suse.com/1209765","tags":["report"]},{"url":"https://bugzilla.suse.com/1209766","tags":["report"]},{"url":"https://bugzilla.suse.com/1209767","tags":["report"]},{"url":"https://bugzilla.suse.com/1209768","tags":["report"]},{"url":"https://bugzilla.suse.com/1209769","tags":["report"]},{"url":"https://bugzilla.suse.com/1209770","tags":["report"]},{"url":"https://bugzilla.suse.com/1209771","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30500","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30501","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43311","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43312","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43313","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43317","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23456","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-23457","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-23456","title":"Upx: heap-buffer-overflow in packtmt::pack()","description":"A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.","status":"published","published":"2023-01-12T00:00:00Z","modified":"2024-12-11T19:02:29.592Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:35:20.812737Z"}],"euvd":[{"id":"EUVD-2023-27556","description":"A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.","status":"published","published":"2023-01-12T00:00:00Z","modified":"2024-12-11T19:02:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:04:36.46341Z"}],"ghsa":[{"id":"GHSA-3j7g-922g-j6r3","title":"A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file....","description":"A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.","status":"published","published":"2023-01-12T21:30:30Z","modified":"2024-12-12T03:32:58Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:59:08.740912Z"}],"nvd":[{"id":"CVE-2023-23456","description":"A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.","status":"published","published":"2023-01-12T19:15:24.693Z","modified":"2026-06-17T05:37:11.033Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:07:45.305824Z"}],"osv":[{"id":"ALPINE-CVE-2023-23456","description":"A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.","status":"published","published":"2023-01-12T19:15:24.693Z","modified":"2026-11-03T06:32:58.947230355Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T07:16:09.603409Z"},{"id":"BELL-CVE-2023-23456","title":"CVE-2023-23456 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:34.517191Z","modified":"2026-01-26T09:48:10.014835Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"CVE-2023-23456","title":"Upx: heap-buffer-overflow in packtmt::pack()","description":"A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.","status":"published","published":"2023-01-12T00:00:00Z","modified":"2026-10-28T10:36:19.065164481Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:44:30.709518Z"},{"id":"DEBIAN-CVE-2023-23456","description":"A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.","status":"published","published":"2023-01-12T19:15:24.693Z","modified":"2026-10-26T18:00:32.518110922Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:39.369204Z"},{"id":"UBUNTU-CVE-2023-23456","description":"A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.","status":"published","published":"2023-01-12T19:15:00Z","modified":"2026-10-17T12:56:04.439756584Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"DLA-3991-1","title":"upx-ucl - security update","status":"published","published":"2024-12-11T00:00:00Z","modified":"2026-03-09T01:22:02.402706Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"MGASA-2023-0052","title":"Updated upx packages fix security vulnerability","description":"Denial of service due to heap-based buffer overflow issue in UPX in\nPackTmt::pack() in p_tmt.cpp file. (CVE-2023-23456)\nDenial of service due to segmentation fault in UPX in\nPackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. (CVE-2023-23457)\n","status":"published","published":"2023-02-20T21:25:36Z","modified":"2026-04-16T04:41:07.981255553Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2023:0088-1","title":"Security update for upx","description":"\nupx was updated to fix the following issues:\n\nUpdate to release 4.0.2\n\n* Fix unpack of ELF x86-64 that failed with 'CantUnpackException: corrupt b_info'\n* Resolve SEGV on PackLinuxElf64::invert_pt_dynamic\n\n- CVE-2021-30500: Fixed Null pointer dereference in PackLinuxElf:canUnpack() in p_lx_elf.cpp\n- CVE-2021-30501: Fixed Assertion abort in function MemBuffer:alloc()\n- CVE-2021-43311: Fixed Heap-based buffer overflow in PackLinuxElf32:elf_lookup() at p_lx_elf.cpp\n- CVE-2021-43312: Fixed Heap-based buffer overflow in PackLinuxElf64:invert_pt_dynamic at p_lx_elf.cpp:5239\n- CVE-2021-43313: Fixed Heap-based buffer overflow in PackLinuxElf32:invert_pt_dynamic at p_lx_elf.cpp:1688\n- CVE-2021-43314: Fixed Heap-based buffer overflows in PackLinuxElf32:elf_lookup() at p_lx_elf.cp\n- CVE-2021-43315: Fixed Heap-based buffer overflows in PackLinuxElf32:elf_lookup() at p_lx_elf.cp\n- CVE-2021-43316: Fixed Heap-based buffer overflow in func get_le64()\n- CVE-2021-43317: Fixed Heap-based buffer overflows in PackLinuxElf64:elf_lookup() at p_lx_elf.cp\n- CVE-2023-23456: Fixed heap-buffer-overflow in PackTmt:pack()\n- CVE-2023-23457: Fixed SEGV on PackLinuxElf64:invert_pt_dynamic() in p_lx_elf.cpp\n","status":"published","published":"2023-04-11T07:07:29Z","modified":"2025-05-07T18:12:22.423988Z","updated_at":"2026-11-02T16:58:32.653274Z"}]}}