Null pointer dereference was found in upx PackLinuxElf::canUnpack() in plxelf.cpp,in version UPX 4.0.0. That allow attackers to execute arbitrary code and cause a denial of service via a crafted file.
{
"unresolved_ranges": [
{
"extracted_events": [
{
"last_affected": "33"
}
],
"cpes": [
"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*"
],
"source": "CPE_FIELD",
"vendor_product": "fedoraproject:fedora"
},
{
"extracted_events": [
{
"last_affected": "7.0"
}
],
"vendor_product": "redhat:enterprise_linux",
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*"
],
"source": "CPE_FIELD"
}
]
}