CVE catalog

CVE-2020-24119

DEBIAN-CVE-2020-24119

[CVE catalog]

Severity
Unknown · CVSS 7.1CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H
Published
Updated
Source
[NVD] · [CVE record]
EPSS
1.08% · Oct 25, 2026

A heap buffer overflow read was discovered in upx 4.0.0, because the check in p_lx_elf.cpp is not perfect.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianupx-ucl134.2.2-1fixed
Debianupx-ucl144.2.2-1fixed
Suseupxpackage hub 15 sp23.96-bp152.2.3.1fixed
Suseupxpackage hub 15 sp33.96-bp153.2.3.1fixed
Opensuseupxleap 15.23.96-bp153.2.3.1fixed
Opensuseupxleap 15.33.96-bp153.2.3.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianupx-ucldeb134.2.2-1Not reportedDEBIAN-CVE-2020-24119Not reported
Debianupx-ucldeb144.2.2-1Not reportedDEBIAN-CVE-2020-24119Not reported
Suseupxrpmpackage hub 15 sp23.96-bp152.2.3.1Not reportedOPENSUSE-SU-2021:0826-1Not reported
Suseupxrpmpackage hub 15 sp33.96-bp153.2.3.1Not reportedOPENSUSE-SU-2021:0813-1Not reported
Opensuseupxrpmleap 15.23.96-bp153.2.3.1Not reportedOPENSUSE-SU-2021:0813-1Not reported
Opensuseupxrpmleap 15.33.96-bp153.2.3.1Not reportedOPENSUSE-SU-2021:0813-1Not reported

OpenFactory catalog packages

[Debian 13 (Trixie)]

  • [upx-ucl]Fixed
    Details (2)

    • 4.2.4-1.1 · amd64 · trixie

      Fixed · Fixed: 4.2.2-1

      pypi · upx-ucl · debian · 13

    • 4.2.4-1.1 · arm64 · trixie

      Fixed · Fixed: 4.2.2-1

      pypi · upx-ucl · debian · 13

Observed:

References

[FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]