p_lx_elf.cpp in UPX 3.94 mishandles ELF headers, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted binary file, as demonstrated by an Invalid Pointer Read in PackLinuxElf64::unpack().

3.94 and patch for CVE-2017-15056

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for upx fixes the following security issue :

  - CVE-2017-15056: specially crafted package may have     caused a denial of service (boo#1062059)

In addition upx was updated to 3.94, with the following improvements :

  - Support for aarch64).

  - Support for --lzma compression on 64-bit PowerPC

ID	Name	Product	Family	Severity
105925	Fedora 27 : upx (2017-89e2655938)	Nessus	Fedora Local Security Checks	high
104079	openSUSE Security Update : upx (openSUSE-2017-1174)	Nessus	SuSE Local Security Checks	high
103952	Fedora 26 : upx (2017-d22c391318)	Nessus	Fedora Local Security Checks	high
103951	Fedora 25 : upx (2017-caafcbd6b9)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-15056

high

Tenable Plugins

high

high

high

high