Version 3.96-3 of upx-ucl is marked for autoremoval from testing on Sun 09 Apr 2023. It is affected by #1031874, #1033258. You should try to prevent the removal by fixing these RC bugs.
CVE-2023-23456:
A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
CVE-2023-23456:
A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
CVE-2023-23456:
A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a crafted file.
Among the 3 debian patches
available in version 3.96-3 of the package,
we noticed the following issues:
2 patches
where the metadata indicates that the patch has not yet been forwarded
upstream. You should either forward the patch upstream or update the
metadata to document its real status.
Standards version of the package is outdated.
wishlist
The package should be updated to follow the last version of Debian Policy
(Standards-Version 4.6.2 instead of
4.6.0).
![[bug history graph]](https://qa.debian.org/data/bts/graphs/u/upx-ucl.png){kind=link}