CVE-2021-43317 | Vulnetix

CVE-2021-43317 PUBLISHED

Reported by fedora · Published March 24, 2023

A heap-based buffer overflows was discovered in upx, during the generic pointer 'p' points to an inaccessible address in func get_le32(). The problem is essentially caused in PackLinuxElf64::elf_lookup() at p_lx_elf.cpp:5404

Affected products

Vendor	Product	Versions
n/a	upx	upx before 4.0.0-git-c6b9e3c62d15
n/a	upx	4.0.0-git-c6b9e3c62d15

Timeline

Mar 24, 2023 CVE Published
Mar 25, 2023 EPSS Score (30 in total, the first dated here)
Feb 25, 2025 CVE Updated
Apr 3, 2026 Security Advisory (2 in total, the first dated here)
Jul 18, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2021-43317
vulnetix vdb fixes CVE-2021-43317

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2021-43317/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →