-------------------------------------------------------------------------------- Fedora EPEL Update Notification FEDORA-EPEL-2020-6d47c64c04 2020-02-10 00:31:58.536377 --------------------------------------------------------------------------------
Name : upx Product : Fedora EPEL 7 Version : 3.96 Release : 1.el7 URL : http://upx.sourceforge.net/ Summary : Ultimate Packer for eXecutables Description : UPX is a free, portable, extendable, high-performance executable packer for several different executable formats. It achieves an excellent compression ratio and offers very fast decompression. Your executables suffer no memory overhead or other drawbacks.
-------------------------------------------------------------------------------- Update Information:
3.96, multiple security fixes. ---- Patch for CVE-2019-20021 -------------------------------------------------------------------------------- ChangeLog:
* Fri Jan 24 2020 Gwyn Ciesla gwync@protonmail.com - 3.96-1 - 3.96 * Fri Jan 17 2020 Gwyn Ciesla gwync@protonmail.com - 3.95-5 - Upstream patch for CVE-2019-20021 * Thu Aug 1 2019 Gwyn Ciesla gwync@protonmail.com - 3.95-4 - Upstream patches for CVE-2019-14295 and CVE-2019-14296. * Sat Jul 27 2019 Fedora Release Engineering releng@fedoraproject.org - 3.95-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild * Sun Feb 3 2019 Fedora Release Engineering releng@fedoraproject.org - 3.95-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild * Mon Aug 27 2018 Gwyn Ciesla limburgher@gmail - 3.95-1 - 3.95. - Switch to upstream's lzma fork. * Sat Jul 14 2018 Fedora Release Engineering releng@fedoraproject.org - 3.94-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild * Fri Feb 9 2018 Fedora Release Engineering releng@fedoraproject.org - 3.94-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild * Tue Oct 10 2017 Gwyn Ciesla limburgher@gmail.com - 3.94-1 - 3.94, plus patch for CVE-2017-15056. * Thu Aug 3 2017 Fedora Release Engineering releng@fedoraproject.org - 3.93-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild * Thu Jul 27 2017 Fedora Release Engineering releng@fedoraproject.org - 3.93-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild * Thu Mar 30 2017 Gwyn Ciesla limburgher@gmail.com - 3.93-1 - Latest upstream, fix for BZ 1429197. * Sat Feb 11 2017 Fedora Release Engineering releng@fedoraproject.org - 3.91-8 - Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild * Fri Feb 5 2016 Fedora Release Engineering releng@fedoraproject.org - 3.91-7 - Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild * Fri Jun 19 2015 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 3.91-6 - Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild * Sat May 2 2015 Kalev Lember kalevlember@gmail.com - 3.91-5 - Rebuilt for GCC 5 C++11 ABI change * Thu Oct 16 2014 Jon Ciesla limburgher@gmail.com - 3.91-4 - Fix FTBFS. * Mon Aug 18 2014 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 3.91-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild * Sun Jun 8 2014 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 3.91-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild * Mon Oct 28 2013 Jon Ciesla limburgher@gmail.com - 3.91-1 - New upstream, BZ 1023719. - Fix bad changelog date. * Sun Aug 4 2013 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 3.09-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild * Mon Mar 18 2013 Jon Ciesla limburgher@gmail.com - 3.09-1 - New upstream. * Fri Feb 15 2013 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 3.08-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild * Sun Jul 22 2012 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 3.08-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild * Fri Jan 27 2012 Jon Ciesla limburgher@gmail.com - 3.08-1 - New upstream. * Sat Jan 14 2012 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 3.07-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_17_Mass_Rebuild * Tue Aug 9 2011 Tom Callaway spot@fedoraproject.org - 3.07-3 - use lzma-sdk system library/headers * Mon Feb 7 2011 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 3.07-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild * Mon Oct 18 2010 Jon Ciesla limb@jcomserv.net - 3.07-1 - New upstream. * Fri Jan 8 2010 Jon Ciesla limb@jcomserv.net - 3.04-2 - LZMA fixes by John Reiser (jreiser@bitwagon.com) BZ 501636. * Mon Nov 16 2009 Jon Ciesla limb@jcomserv.net - 3.04-1 - 3.04. - Stict prototype patch upstreamed. * Sun Jul 26 2009 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 3.03-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild * Fri Feb 27 2009 Jon Ciesla limb@jcomserv.net - 3.03-3 - Patch for stricter glibc. * Wed Feb 25 2009 Fedora Release Engineering rel-eng@lists.fedoraproject.org - 3.03-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild * Thu May 8 2008 Jon Ciesla limb@jcomserv.net - 3.03-1 - 3.03. * Fri Feb 8 2008 Jon Ciesla limb@jcomserv.net - 3.02-2 - GCC 4.3 rebuild. * Mon Dec 31 2007 Jon Ciesla limb@jcomserv.net - 3.02-1 - 3.02. * Thu Aug 16 2007 Jon Ciesla limb@jcomserv.net - 3.01-2 - License tag correction. * Mon Aug 6 2007 Jon Ciesla limb@jcomserv.net - 3.01-1 - 3.01. * Sun May 13 2007 Ville Skytt�� <ville.skytta at iki.fi> - 3.00-1 - 3.00. * Wed Apr 4 2007 Ville Skytt�� <ville.skytta at iki.fi> - 2.03-1 - 2.03. * Wed Aug 30 2006 Ville Skytt�� <ville.skytta at iki.fi> - 2.02-1 - 2.02. * Tue May 16 2006 Ville Skytt�� <ville.skytta at iki.fi> - 2.00-2 - BR: zlib-devel. * Tue May 16 2006 Ville Skytt�� <ville.skytta at iki.fi> - 2.00-1 - 2.00. * Wed Feb 15 2006 Ville Skytt�� <ville.skytta at iki.fi> - 1.25-5 - Rebuild. * Thu May 19 2005 Ville Skytt�� <ville.skytta at iki.fi> - 1.25-4 - Rebuild. * Fri Apr 8 2005 Michael Schwendt <mschwendt[AT]users.sf.net> - 1.25-3 - rebuilt * Fri Dec 17 2004 Ville Skytt�� <ville.skytta at iki.fi> - 0:1.25-2 - Let rpmbuild take care of stripping binaries. - Honor build environment settings better. * Thu Jul 1 2004 Ville Skytt�� <ville.skytta at iki.fi> - 0:1.25-0.fdr.1 - Update to 1.25. * Mon May 3 2004 Ville Skytt�� <ville.skytta at iki.fi> - 0:1.24-0.fdr.3 - Add workaround for building with UCL 1.02, thanks to upstream. * Sun Nov 16 2003 Ville Skytt�� <ville.skytta at iki.fi> - 0:1.24-0.fdr.2 - Spec cleanup. * Sat Jul 26 2003 Ville Skytt�� <ville.skytta at iki.fi> - 0:1.24-0.fdr.1 - First build. -------------------------------------------------------------------------------- References:
[ 1 ] Bug #1792327 - CVE-2019-20021 upx: heap-based buffer overflow in canUnpack in p_mach.cpp [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1792327 [ 2 ] Bug #1581264 - CVE-2018-11243 upx: Double-free in PackLinuxElf64::unpack in p_lx_elf.cpp allows denial of service [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1581264 [ 3 ] Bug #1794720 - CVE-2019-20051 upx: floating point exception in PackLinuxElf::elf_hash in p_lx_elf.cpp [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1794720 [ 4 ] Bug #1794722 - CVE-2019-20051 upx: floating point exception in PackLinuxElf::elf_hash in p_lx_elf.cpp [epel-8] https://bugzilla.redhat.com/show_bug.cgi?id=1794722 [ 5 ] Bug #1794721 - CVE-2019-20051 upx: floating point exception in PackLinuxElf::elf_hash in p_lx_elf.cpp [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1794721 [ 6 ] Bug #1792328 - CVE-2019-20021 upx: heap-based buffer overflow in canUnpack in p_mach.cpp [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1792328 [ 7 ] Bug #1581263 - CVE-2018-11243 upx: Double-free in PackLinuxElf64::unpack in p_lx_elf.cpp allows denial of service [epel-7] https://bugzilla.redhat.com/show_bug.cgi?id=1581263 [ 8 ] Bug #1792329 - CVE-2019-20021 upx: heap-based buffer overflow in canUnpack in p_mach.cpp [epel-8] https://bugzilla.redhat.com/show_bug.cgi?id=1792329 --------------------------------------------------------------------------------
This update can be installed with the "yum" update programs. Use su -c 'yum update upx' at the command line. For more information, refer to "YUM", available at https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7%5C /html/System_Administrators_Guide/ch-yum.html
All packages are signed with the Fedora EPEL GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys --------------------------------------------------------------------------------
epel-package-announce@lists.fedoraproject.org