An Integer overflow in the getElfSections function in p_vmlinx.cpp in UPX 3.95 allows remote attackers to cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX packed executable, which triggers an allocation of excessive memory.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - An Integer overflow in the getElfSections function in p_vmlinx.cpp in UPX 3.95 allows remote attackers to     cause a denial of service (crash) via a skewed offset larger than the size of the PE section in a UPX     packed executable, which triggers an allocation of excessive memory. (CVE-2019-14295)

Note that Nessus relies on the presence of the package as reported by the vendor.

Patches for CVE-2019-14295, CVE-2019-14296

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
250519	Linux Distros Unpatched Vulnerability : CVE-2019-14295	Nessus	Misc.	medium
127526	Fedora 29 : upx (2019-bf4633142b)	Nessus	Fedora Local Security Checks	high
127520	Fedora 30 : upx (2019-9a0f02c8c8)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2019-14295

medium

Tenable Plugins

medium

high

high