Stay Secure with the Latest Linux Advisories

security advisorybuffer overflowcritical

Fedora 36: FEDORA-2023-8d91390935 Critical: upx Buffer Overflow

Patches for CVE-2023-23456 and CVE-2023-23457. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-8d91390935 2023-01-22 01:47:35.218330 --------------------------------------------------------------------------------Name : upx Product : Fedora 36 Version : 4.0.1 Release : 2.fc36 URL : https://github.com/upx/upx Summary : Ultimate Packer for eXecutables Description : UPX is a free, portable, extendable, high-performance executable packer for several different executable formats. It achieves an excellent compression ratio and offers very fast decompression. Your executables suffer no memory overhead or other drawbacks. --------------------------------------------------------------------------------Update Information: Patches for CVE-2023-23456 and CVE-2023-23457 --------------------------------------------------------------------------------ChangeLog: * Thu Jan 12 2023 Gwyn Ciesla - 4.0.1-2 - Patches for CVE-2023-23456, CVE-2023-23457 * Thu Nov 17 2022 Gwyn Ciesla - 4.0.1-1 - 4.0.1 * Fri Nov 4 2022 Gwyn Ciesla - 4.0.0-1 - 4.0.0 * Sat Jul 23 2022 Fedora Release Engineering - 3.96-12 - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild --------------------------------------------------------------------------------References: [ 1 ] Bug #2160383 - CVE-2023-23456 upx: heap-buffer-overflow in PackTmt::pack() [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2160383 [ 2 ] Bug #2160385 - CVE-2023-23457 upx: SEGV on PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=2160385 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-8d91390935' at the command line. For more information, refer to the dnf documentation availableat https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam, report it: . Fedora 36 has issued updates for UPX addressing major security flaws such as memory corruption and access violations.. Fedora Updates, Upx Security, Process Vulnerabilities, Threat Management. . Severity: Critical. LinuxSecurity.com Team

Jan 22, 2023 •Critical Fedora