7.8

CVE-2018-11243: upx Double Free

CVSS: 7.8v3.0HighModified
AliasesopenSUSE-SU-2020:0179-1UBUNTU-CVE-2018-11243DEBIAN-CVE-2018-11243
Published 18-05-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-11243 is a high (CVSS 7.8) Double Free vulnerability in upx. EPSS estimates a 2.42% chance of exploitation in the next 30 days, higher than 84% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
42/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.8/10
010
High · v3.0 (NVD)
EPSS score
2.42%
0%100%
Low · -0.97 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 4 · Related 3
MGASA-2020-0096OPENSUSE-SU-2020:0163-1OPENSUSE-SU-2020:0180-1OPENSUSE-SU-2024:11486-1

Timeline

  1. 18-05-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote attackers to cause a denial of service (double free), limit the ability of a malware scanner to operate on the entire original data, or possibly have unspecified other impact via a crafted file.

CVSS metrics

4 scores · 3 sources · 2 versions

EPSS trend

Probability

2.42%

Chance of exploitation in the next 30 days

Percentile

84%

Versus all other CVEs

30-day change

-0.97 pp

From 3.39% on 21-09-2026

21-09-202621-10-2026
EPSS score
2.42%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • githubUnverified

    Upx

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Opensuse2 products
  • ucl&distro=openSUSE Leap 15.1< 1.03-lp151.3.3.1
  • ucl&distro=openSUSE Tumbleweed< 1.03-4.9
Debian1 product
  • upx-ucl< 1.03+repack-5
Suse1 product
  • ucl&distro=SUSE Package Hub 15 SP1< 1.03-bp151.4.3.1
Ubuntu1 product
  • upx-uclAll versions (No fix recorded)
Upx1 product

5 vendors · 6 products

References

16 links
Show all 16 references