CVE-2019-20021

A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.

• CWE-125

• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00003.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00007.htmlBroken Link
• https://github.com/upx/upx/issues/315Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D7XU42G6MUQQXHWRP7DCF2JSIBOJ5GOO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUTVSTXAFTD552NO2K2RIF6MDQEHP3BE/
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00003.htmlBroken Link
• http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00007.htmlBroken Link
• https://github.com/upx/upx/issues/315Exploit, Issue Tracking, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D7XU42G6MUQQXHWRP7DCF2JSIBOJ5GOO/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EUTVSTXAFTD552NO2K2RIF6MDQEHP3BE/

Published

Dec 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-20015An issue was discovered in GNU LibreDWG 0.92. Crafted input …6.5
• CVE-2019-20016libmysofa before 2019-11-24 does not properly restrict recur…6.5
• CVE-2019-20017A stack-based buffer over-read was discovered in Mat_VarRead…6.5
• CVE-2019-20018A stack-based buffer over-read was discovered in ReadNextCel…6.5
• CVE-2019-20019An attempted excessive memory allocation was discovered in M…6.5
• CVE-2019-20020A stack-based buffer over-read was discovered in ReadNextStr…6.5
• CVE-2019-20022An invalid memory address dereference was discovered in load…6.5
• CVE-2019-20023A memory leak was discovered in image_buffer_resize in froms…6.5
• CVE-2019-20024A heap-based buffer overflow was discovered in image_buffer_…6.5
• CVE-2019-20025Certain builds of NEC SV9100 software could allow an unauthe…9.8
• CVE-2019-20026The WebPro interface in NEC SV9100 software releases 7.0 or …7.5
• CVE-2019-20027Aspire-derived NEC PBXes, including the SV8100, SV9100, SL11…9.8