Hi,

The following vulnerability was published for upx-ucl.

CVE-2018-11243[0]:
| PackLinuxElf64::unpack in p_lx_elf.cpp in UPX 3.95 allows remote
| attackers to cause a denial of service (double free), limit the ability
| of a malware scanner to operate on the entire original data, or
| possibly have unspecified other impact via a crafted file.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2018-11243
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11243
[1] https://github.com/upx/upx/issues/206
[2] https://github.com/upx/upx/issues/207

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
ucl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 907426@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Robert Luberda <robert@debian.org> (supplier of updated ucl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 09 Sep 2018 20:57:20 +0200
Source: ucl
Binary: libucl1 libucl-dev
Architecture: source amd64
Version: 1.03+repack-5
Distribution: unstable
Urgency: medium
Maintainer: Robert Luberda <robert@debian.org>
Changed-By: Robert Luberda <robert@debian.org>
Description:
 libucl-dev - Portable compression library - development
 libucl1    - Portable compression library - runtime
Closes: 804474 907426
Changes:
 ucl (1.03+repack-5) unstable; urgency=medium
 .
   * Add 05-Fix-double-free.patch from John Reiser to fix memory clobbering
     issue visible in upx (closes: #907426).
   * New 06-Fix-memory-errors.patch to initialize memory in order to get rid
     of memory errors detected by valgrind in a test program included in the
     bug report (closes: #804474).
   * Add 07-Fix-FTBFS-on-x32.patch that hopefully fixes compilation on x32 arch.
   * Bump debhelper's compat version to 11.
   * debian/rules:
     + enable `pie' hardening option;
     + do not use dpkg-parsechangelog (lintian);
     + enable LFS flags (lintian).
   * Document files removed from the upstream tarball in Files-Excluded
     field of debian/copyright (lintian) and update debian/watch for
     automatic creation of the tarball.
   * Add DEP-12 upstream metadata file.
   * debian/control:
     + update Vcs-* fields for salsa migration;
     + use https protocol in the `Homepage' field;
     + set `Rules-Requires-Root' to `no';
     + Standards-Version: 4.2.1.
Checksums-Sha1:
 3e3300b79cdc691c8a5c2456f496a4aea62d996a 1877 ucl_1.03+repack-5.dsc
 7f93015526843b69569793e7ba2b690e77959fdb 9976 ucl_1.03+repack-5.debian.tar.xz
 6e90805526ac776a40c29d7662fcbf0264ecd11b 37776 libucl-dev_1.03+repack-5_amd64.deb
 bc166305143f554d4c415d883e5efa4188fd4890 60628 libucl1-dbgsym_1.03+repack-5_amd64.deb
 cf74e7028d532db758c9176234a14865fd3a486a 26232 libucl1_1.03+repack-5_amd64.deb
 0fcd3423d24100b216d8da794b0a73de71c0b04f 6124 ucl_1.03+repack-5_amd64.buildinfo
Checksums-Sha256:
 71be06ad4dad18f6a7e07fad21d615279eaee687877d53b9c2bac1673ced1d03 1877 ucl_1.03+repack-5.dsc
 e9a854ddb1caa902c5b05c1246acb7b183bdea748bcbc1204f3034bdb1e7db99 9976 ucl_1.03+repack-5.debian.tar.xz
 ec95c9f75b95c4e8ceafe41ecdfb8fb59231781e159dd8085e8ae5cf11530aec 37776 libucl-dev_1.03+repack-5_amd64.deb
 19259a1767cba8df1c7c224ad2c2e7725f5887bd5cb6c2fd84d6c04af85348fc 60628 libucl1-dbgsym_1.03+repack-5_amd64.deb
 8210713cc4f21b63e666e395d61d4da0ec77ee0d000ce9f31f83b05fa4d78429 26232 libucl1_1.03+repack-5_amd64.deb
 7030c45f626a7a202fe6abe87543b08892bf376bf93f7b9df9d7e71365ca54ee 6124 ucl_1.03+repack-5_amd64.buildinfo
Files:
 0541b6769bfa2b8e315a0fe61b1faa94 1877 libs optional ucl_1.03+repack-5.dsc
 e989ca74c2b5801b5425dcd74bfb6b5a 9976 libs optional ucl_1.03+repack-5.debian.tar.xz
 dfcb3f4005391e824ef4adda79db7bea 37776 libdevel optional libucl-dev_1.03+repack-5_amd64.deb
 bf45a47d90ce10770831421458ae1b7b 60628 debug optional libucl1-dbgsym_1.03+repack-5_amd64.deb
 68cd75e1f5ee13c6f99dee3f596c7291 26232 libs optional libucl1_1.03+repack-5_amd64.deb
 2d17fa9cec7fa8c4688177e4fa723734 6124 libs optional ucl_1.03+repack-5_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEENeh2+rTTcy6TtNI3Yx3nVTvor9QFAluVbXIACgkQYx3nVTvo
r9QiYRAAigqhG7FqSz42LxD9BfGZJMKKjumKNNfU4Xl+QI12KSLbf98t5oK9dGM+
OX8LXxc5KjQZw4g6nVm8cHVXWBSpBsfpyOwJWy2KwFoxVXjgnxh6M3vXBZkoKrH+
MDP6u01artWhrRIvn5eNXgHVVoejvrxGSf2CpIMx7/z60hOSi9g8i6FcmOrNHdmw
EdSyPaTdlB1V70SC6IcNEi6dagPOhtnsbo5E1m4MFEVIgrQWf8R+l9DVFN79h6KQ
o9cHo4hfRwyJA9E5vORbBu0XIacFZEdBUWeapP3WQQJPCgWhe+jUjcBjk9jLgC8w
xYWI2JI4o9CmPICVQOfbqAJxNuIjUzsSZETkV7BeI7GqV44XU+NjrJ0R93o7/goY
3o1OIKRlMyxtYS0MqOnY6fTGm2rOpRHWxC6lSHGJYS6c/nQokxZqzbLBm1rcGOMx
dXZ+T9ktuTPGskDGjbBlDRzNBmWYooQ/LwGBd1AfCHHND7oi7RwvvRcBqAefUOYk
m27A0f5uCRJSflaKR6aPY1+1zS2Ue7C2VZY/Yp3Ln/ydPPrLfRDrDld6Mtjj9ubt
Kzv32Y2zaglnaFOkpL9aZjGbMTuCefv07PULAaFwmp6D5T/KuUto5nseXH+BFYca
aSKFZJwsCyis3ucd0M8zuMHoTOcJO/0z4NayLYbjV4YmMUVRd5Q=
=Ujc9
-----END PGP SIGNATURE-----

We believe that the bug you reported is fixed in the latest version of
ucl, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 907426@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Bastian Germann <bage@debian.org> (supplier of updated ucl package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 31 Aug 2026 22:50:08 +0200
Source: ucl
Architecture: source
Version: 1.03+repack-6.1
Distribution: unstable
Urgency: medium
Maintainer: Robert Luberda <robert@debian.org>
Changed-By: Bastian Germann <bage@debian.org>
Closes: 907426
Changes:
 ucl (1.03+repack-6.1) unstable; urgency=medium
 .
   * Non-maintainer upload
   * Add missing double free fix for existing patch (Closes: #907426)
Checksums-Sha1:
 a36e4d10c72dceb56688060d7fc5136b270bc5af 1744 ucl_1.03+repack-6.1.dsc
 4e41b9d48d85bbf51352fa7b571464b0364062ac 10400 ucl_1.03+repack-6.1.debian.tar.xz
 3961c402fdaf054e7639b22033210601229fe7b9 5551 ucl_1.03+repack-6.1_source.buildinfo
Checksums-Sha256:
 d5ce45a46bada7420bd9f9c28b2d8eac2878ade9d89e410a56ef78ed277af474 1744 ucl_1.03+repack-6.1.dsc
 c33c19625818c01daf8cb968a53a5d846a93d7b36da57a88f160ae2f1977387d 10400 ucl_1.03+repack-6.1.debian.tar.xz
 102117276e8a039913d0f461643a62af95e8b188dee99c5d256c3e87fcdc3364 5551 ucl_1.03+repack-6.1_source.buildinfo
Files:
 37eca864cec9a2cd652105d6183f05a6 1744 libs optional ucl_1.03+repack-6.1.dsc
 885113cbbfa78a3331606f203c73ffbc 10400 libs optional ucl_1.03+repack-6.1.debian.tar.xz
 0a75283d19d14336c2cdfe0e4c10dda6 5551 libs optional ucl_1.03+repack-6.1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQHEBAEBCgAuFiEEQGIgyLhVKAI3jM5BH1x6i0VWQxQFAmqV6VQQHGJhZ2VAZGVi
aWFuLm9yZwAKCRAfXHqLRVZDFId4DADDvqvxDzS39k5YQiRAEPDWcrkDCD0Zv1Hi
emCnVyJpYolI/opaxafPD4Ma4O18UL7nLkhvST1QDb/8Fkp9sW2DoKpAQOJD/7dt
Pwjkrhrw4ZC10SdEwclMJRWw8c8jDoZCaewQSAhJ24hsRUu+C9wRMPCR/jF3og22
zFhZq4gEmxfJcghxlnuU1CxG43yhVB3hZwpXE47YnLk9IesALTgrw3466pHw5Uqo
RrQ4SzYWrWGxUFydKGZS9ZLHk9uANqbsdmPmrkHfHIqRcyctba0XVI8w5sD7nses
wSMeP8LgWUR9w49TjdyCoUkPfETTEFPqmO9cfR2bdq6jZaYl9h8yUeoamhZXU6p+
kkcMgCwIKO8mUH7g0xiCYf1UQVp9bqHxc6N0yJyV0nqz2MvnF6xoFHypzoMt4zV9
oraxU5+Pp0Iqgf3rrSsgZs/a0LRPi5czwn2DJ7uL+pG80+SJxSkz1Nb2m7bToezt
k3RSXW2RazzOal6LKNGHQq6QjqUwHe8=
=AiM9
-----END PGP SIGNATURE-----