CVE and update status of the FreeBSD ports tree3,295 unaddressed CVEs in 670 portsAll times are CET
Port details

archivers/upx 5.2.1

Ultimate Packer for eXecutables

0
unaddressed
0
VuXML only
0
fixed
0
open problem reports

Port info

Maintainer
sunpoet@FreeBSD.org
Packages
latest: 5.2.1
Upstream
up to date
Last update
to 5.2.1 · 74db5e3bb0
Quarterly
2026Q4: 5.2.1
WWW
https://upx.github.io/
Links
cgit · VuXML

Install

Package
# pkg install upx
installs 5.2.1 from latest; from quarterly (2026Q4) 5.2.1
Port
# cd /usr/ports/archivers/upx && make install clean
# make -C /usr/ports/archivers/upx config  # change options first
Size
780 KiB download · 3.1 MiB installed
Depends on
archivers/ucl 1.03_5
License
GPLv2+
Options
1 of 1 on in the package: DOCS

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 165.2.15.2.1–
FreeBSD 155.2.15.2.1–
FreeBSD 145.2.15.2.15.2.1

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 155.2.15.2.1–
FreeBSD 145.2.15.2.15.2.1

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed and VuXML only (0)

No unaddressed CVE and nothing reported by pkg audit for the packaged version 5.2.1.

Not counted (2)

CVEs that match this port only loosely: inherited from the whole project, or with versions that cannot be compared. What does this mean?

2 with versions that cannot be compared
The CVE record gives dates or the port uses snapshot versions (or the other way round), so the version of this port cannot be placed in the affected range.
CVECVSSPublishedDescription
CVE-2023-234565.32023-01-12A heap-based buffer overflow issue was discovered in UPX in PackTmt::pack() in p_tmt.cpp file. The flow allows an attacker to cause a denial of service (abort) via a cra…
CVE-2023-234575.32023-01-12A Segmentation fault was found in UPX in PackLinuxElf64::invert_pt_dynamic() in p_lx_elf.cpp. An attacker with a crafted input file allows invalid memory address access …

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (62)

Po-Chuan Hsieh (sunpoet) · 5.2.1
archivers/upx: Update to 5.2.1

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
74db5e3bb0
Po-Chuan Hsieh (sunpoet) · 5.2.0
archivers/upx: Update to 5.2.0

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
ba23d43c80
Bernhard Froehlich (decke) · 5.1.1
archivers/upx: Fix CPE data

According to NVD CPE Dictionary upx_project:upx is deprecated in favour
of upx:upx
511af954a8
Po-Chuan Hsieh (sunpoet) · 5.1.1
archivers/upx: Update to 5.1.1

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
4f0f7d4d0c
Po-Chuan Hsieh (sunpoet) · 5.1.0
archivers/upx: Update to 5.1.0

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
05a1e6be0f
Po-Chuan Hsieh (sunpoet) · 5.0.2
archivers/upx: Update to 5.0.2

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
0b252cfd48
Po-Chuan Hsieh (sunpoet) · 5.0.1
archivers/upx: Update to 5.0.1

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
4ec0fdaa2a
Po-Chuan Hsieh (sunpoet) · 5.0.0
archivers/upx: Update to 5.0.0

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
0e6ed560a4
Po-Chuan Hsieh (sunpoet) · 4.2.4
archivers/upx: Update to 4.2.4

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
8c924a213a
Po-Chuan Hsieh (sunpoet) · 4.2.3
archivers/upx: Update to 4.2.3

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
64dbe4b427
Po-Chuan Hsieh (sunpoet) · 4.2.2
archivers/upx: Update to 4.2.2

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
f4245cc6ab
Po-Chuan Hsieh (sunpoet) · 4.2.1
archivers/upx: Update to 4.2.1

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
b7b13d67bd
Po-Chuan Hsieh (sunpoet) · 4.2.0
archivers/upx: Update to 4.2.0

Changes:	https://github.com/upx/upx/releases
		https://github.com/upx/upx/blob/master/NEWS
6cb4ff5d55
Po-Chuan Hsieh (sunpoet) · 4.1.0
archivers/upx: Update to 4.1.0

Changes:	https://github.com/upx/upx/releases
42929fa09f
Po-Chuan Hsieh (sunpoet) · 4.0.2
archivers/upx: Update to 4.0.2

- Update WWW
- Update LICENSE_FILE
- Add DOCS option

Changes:	https://github.com/upx/upx/releases
27eea36612
Muhammad Moinur Rahman (bofh) · 3.96
*/*: llvm15 build fixes

llvm15 was also merged into 13.2-STABLE effective from OSVERSION
1302505. Fix the ports that failed to build with llvm15.

Approved by:	portmgr (blanket)
9b178ffd7e
Po-Chuan Hsieh (sunpoet) · 3.96
archivers/upx: Fix build on 14-CURRENT

In file included from filteri.cpp:71:
./filter/cto.h:47:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
In file included from filteri.cpp:73:
./filter/cto.h:47:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
In file included from filteri.cpp:79:
./filter/cto.h:47:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
In file included from filteri.cpp:81:
./filter/cto.h:47:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
In file included from filteri.cpp:87:
./filter/cto.h:47:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
In file included from filteri.cpp:89:
./filter/cto.h:47:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
In file included from filteri.cpp:100:
./filter/ctoj.h:51:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
In file included from filteri.cpp:102:
./filter/ctoj.h:51:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
In file included from filteri.cpp:115:
./filter/ctok.h:52:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
In file included from filteri.cpp:117:
./filter/ctok.h:52:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
In file included from filteri.cpp:141:
./filter/ctojr.h:109:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
In file included from filteri.cpp:143:
./filter/ctojr.h:109:39: error: variable 'noncalls2' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned calls = 0, noncalls = 0, noncalls2 = 0;
                                      ^
12 errors generated.

Reference:	https://pkg-status.freebsd.org/beefy18/data/main-amd64-default/pdf5b273c8e36_s83d5725005/logs/upx-3.96.log
95c89d246a
Stefan Eßer (se) · 3.96
Remove WWW entries moved into port Makefiles

Commit b7f05445c00f has added WWW entries to port Makefiles based on
WWW: lines in pkg-descr files.

This commit removes the WWW: lines of moved-over URLs from these
pkg-descr files.

Approved by:		portmgr (tcberner)
fb16dfecae
Stefan Eßer (se) · 3.96
Add WWW entries to port Makefiles

It has been common practice to have one or more URLs at the end of the
ports' pkg-descr files, one per line and prefixed with "WWW:". These
URLs should point at a project website or other relevant resources.

Access to these URLs required processing of the pkg-descr files, and
they have often become stale over time. If more than one such URL was
present in a pkg-descr file, only the first one was tarnsfered into
the port INDEX, but for many ports only the last line did contain the
port specific URL to further information.

There have been several proposals to make a project URL available as
a macro in the ports' Makefiles, over time.

This commit implements such a proposal and moves one of the WWW: entries
of each pkg-descr file into the respective port's Makefile. A heuristic
attempts to identify the most relevant URL in case there is more than
one WWW: entry in some pkg-descr file. URLs that are not moved into the
Makefile are prefixed with "See also:" instead of "WWW:" in the pkg-descr
files in order to preserve them.

There are 1256 ports that had no WWW: entries in pkg-descr files. These
ports will not be touched in this commit.

The portlint port has been adjusted to expect a WWW entry in each port
Makefile, and to flag any remaining "WWW:" lines in pkg-descr files as
deprecated.

Approved by:		portmgr (tcberner)
b7f05445c0
Tobias C. Berner (tcberner) · 3.96
archivers: remove 'Created by' lines

A big Thank You to the original contributors of these ports:

  *  Aaron Dalton <aaron@FreeBSD.org>
  *  Akinori MUSHA aka knu <knu@idaemons.org>
  *  Albert Vernon <f3cun3c02@sneakemail.com>
  *  Alex Dupre <ale@FreeBSD.org>
  *  Alex Samorukov <samm@freebsd.org>
  *  Alexander Kuehn <freebsd@nagilum.org>
  *  Alexander Logvinov <ports@logvinov.com>
  *  Alexander Zhuravlev <zaa@zaa.pp.ru>
  *  Alexey Dokuchaev <danfe@FreeBSD.org>
  *  Alexey Dokuchaev <danfe@regency.nsu.ru>
  *  Anders Nordby <anders@FreeBSD.org>
  *  Andreas Klemm <andreas@klemm.gtn.com>
  *  Andreev Maxim
  *  Andrew Pantyukhin <infofarmer@FreeBSD.org>
  *  Andrey Chernov <ache@FreeBSD.org>
  *  Andrey Kostenko <andrey@kostenko.name>
  *  Anes Mukhametov <anes@anes.su>
  *  Antonio Carlos Venancio Junior (<antonio@inf.ufsc.br>)
  *  Ayumi M <ayu@commun.jp>
  *  Carsten Larsen <cs@innolan.dk>
  *  Chin-San Huang <chinsan.tw@gmail.com>
  *  Chris D. Faulhaber <jedgar@FreeBSD.org>
  *  Chris Larsen <darth@vader.dk>
  *  Christopher Key <cjk32@cam.ac.uk>
  *  Cyrille Lefevre <cyrille.lefevre@laposte.net>
  *  Dmitry Sivachenko <demon@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@FreeBSD.org>
  *  Emanuel Haupt <ehaupt@critical.ch>
  *  Felix Palmen <felix@palmen-it.de>
  *  Gabor Kovesdan <gabor@FreeBSD.org>
  *  Gea-Suan Lin (gslin@ccca.nctu.edu.tw)
  *  Gea-Suan Lin <gslin@gslin.org>
  *  George Reid <greid@ukug.uk.freebsd.org>
  *  Greg Lewis <glewis@FreeBSD.org>
  *  Hsin-Han You <hhyou@cs.nctu.edu.tw>
  *  Hye-Shik Chang
  *  Hye-Shik Chang <perky@FreeBSD.org>
  *  Igor Pokrovsky <tiamat@telegraph.spb.ru>
  *  Jaap Boender <jaapb@kerguelen.org>
  *  Jean-Yves Lefort <jylefort@brutele.be>
  *  Jeff Burchell <toxic@doobie.com>
  *  Jeffrey H. Johnson <CPE1704TKS@bellsouth.net>
  *  Jerry Hicks
  *  Joao Carlos Mendes Luis <jonny@jonny.eng.br>
  *  John Marino <marino@FreeBSD.org>
  *  José García Juanino <jjuanino@gmail.com>
  *  Juergen Lock <nox@jelal.kn-bremen.de>
  *  Kevin Golding <ports@caomhin.org>
  *  Konstantin Reznichenko <kot@premierbank.dp.ua>
  *  Koop Mast <kwm@FreeBSD.org>
  *  Kubilay Kocak <koobs@FreeBSD.org>
  *  Lars Thegler <lth@FreeBSD.org>
  *  Mario Sergio Fujikawa Ferreira <lioux@FreeBSD.org>
  *  Mark Felder <feld@FreeBSD.org>
  *  Mark Kane <mark@mkproductions.org>
  *  Mark Pulford <mark@kyne.com.au>
  *  Martin Matuska <mm@FreeBSD.org>
  *  Martin Wilke <miwi@FreeBSD.org>
  *  Matteo Cypriani <mcy@lm7.fr>
  *  Max Khon <fjoe@FreeBSD.org>
  *  Maxim Sobolev <sobomax@FreeBSD.org>
  *  Melvyn Sopacua <melvyn@magemana.nl>
  *  Miguel Mendez <flynn@energyhq.homeip.net>
  *  Nathan Ahlstrom <nra@FreeBSD.org>
  *  Nicola Vitale <nivit@FreeBSD.org>
  *  Patrick Seal <patseal@hyperhost.net>
  *  Pav Lucistnik <pav@FreeBSD.org>
  *  Per Wigren
  *  Philippe Casidy <pcasidy@casidy.com>
  *  Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Poul-Henning Kamp <phk@FreeBSD.org>
  *  Radim Kolar
  *  Radim Kolar <hsn@filez.com>
  *  Radim Kolar <hsn@netmag.cz>
  *  Rainer Hurling <rhurlin@gwdg.de>
  *  Richard Gallamore <ultima@FreeBSD.org>
  *  Roman Shterenzon <roman@xpert.com>
  *  Ryan Steinmetz <zi@FreeBSD.org>
  *  Sam Lawrance <boris@brooknet.com.au>
  *  Sergey A. Osokin <osa@FreeBSD.org>
  *  Sergey Skvortsov <skv@protey.ru>
  *  Sir l33tname <sirl33tname@gmail.com>
  *  Stanislav Sedov <ssedov@mbsd.msk.ru>
  *  Stefan Esser <se@FreeBSD.org>
  *  Steve Wills <swills@FreeBSD.org>
  *  Steven Kreuzer <skreuzer@FreeBSD.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@FreeBSD.org>
  *  Sunpoet Po-Chuan Hsieh <sunpoet@sunpoet.net>
  *  Sylvio Cesar <sylvio@FreeBSD.org>
  *  TAKATSU Tomonari <tota@FreeBSD.org>
  *  Thierry Thomas <thierry@pompo.net>
  *  Thomas Abthorpe <thomas@goodking.ca>
  *  Thomas Gellekum <tg@FreeBSD.org>
  *  Vanilla I. Shu <vanilla@FreeBSD.org>
  *  Wen Heping <wenheping@gmail.com>
  *  Will Andrews <andrews@technologist.com>
  *  Yarodin <yarodin@gmail.com>
  *  Ying-Chieh Liao <ijliao@FreeBSD.org>
  *  Yuri Victorovich <yuri@rawbw.com>
  *  ache
  *  adamw
  *  antoine@FreeBSD.org
  *  bf <bf2006a@yahoo.com>
  *  chinsan <chinsan.tw@gmail.com>
  *  giffunip@asme.org
  *  gurkan@phys.ethz.ch
  *  iblis <iblis.dif01@nctu.edu.tw>
  *  ijliao
  *  jmz
  *  kwm@FreeBSD.org
  *  lbartoletti <lbartoletti@FreeBSD.org>
  *  mm
  *  ports@c0decafe.net <ports@c0decafe.net>
  *  samm@freebsd.org
  *  swhetzel@gmail.com
  *  will

With hat:	portmgr
1ced9d288a
Po-Chuan Hsieh (sunpoet) · 3.96
archivers/upx: Use upstream release tarball
98deea4a7f
Po-Chuan Hsieh (sunpoet) · 3.96
archivers/upx: Update to 3.96

- Remove DOCS option
- Update pkg-descr
- Take maintainership

Changes:	https://github.com/upx/upx/releases
1db1502ff3
Rene Ladan (rene) · 3.95
all: return fjoe's ports to the pool

fjoe's ports bit got safekept.
a67b5dd8d0
Bernhard Froehlich (decke) · 3.95
archivers/upx: Add CPE information

Approved by:	portmgr (blanket)
ab761c5104
Dimitry Andric (dim) · 3.95
archivers/upx: fix build with clang 13

During an exp-run for llvm 13 (see bug 258209), it turned out that
archivers/upx fails to build with clang 13:

p_wcle.cpp:739:27: error: variable 'n' set but not used [-Werror,-Wunused-but-set-variable]
    unsigned count,object,n,r;
                          ^
1 error generated.

This is because clang 13 now has a -Wunused-but-set-variable warning
similar to gcc's, and it is enabled under -Wall.

The p_wcle.cpp file has two instances where the 'n' variable is used for
debugging purposes, but the first instance is marked with UNUSED(n). The
second is not, triggering this warning. Fix it by also marking the
second instance with UNUSED(n).

PR:		258394
Approved by:	maintainer timeout (3 weeks)
89909595ad
Po-Chuan Hsieh (sunpoet) · 3.95
archivers/upx: Update WWW

Approved by:	portmgr (blanket)
e7680ba883
Mathieu Arnold (mat) · 3.95
Remove # $FreeBSD$ from Makefiles.
305f148f48
Max Khon (fjoe) · 3.95
Fix build with clang 10

PR:		244636
Submitted by:	Dimitry Andric
ebaffa0a43
Kubilay Kocak (koobs) · 3.95
archivers/upx: Fix build due to missing perl (pod2*) tools

upx unconditionally runs its docs target, which relies on multiple [1] pod2*
tools provided by perl.

USES=perl and USE_PERL=build were removed in ports r478489, resulting in those
tools not being available at build time, and the following errors:

  /bin/sh: pod2man: not found
  /bin/sh: pod2html: not found
  /bin/sh: pod2text: not found

This change, accordingly, re-adds perl as an unconditional build dependency,
including a comment about what its for.

While I'm here:

  * Update COMMENT for (portlint) compliance [2]

[1] pod2man, pod2html, pod2text
[2] Wikipedia, MajorGeeks and others also describe UPX without a "The" prefix

PR:		234002
Reported by:	<mail ozzmosis com>
Approved by:	portmgr (blanket: build fix, JFI)
MFH:		2018Q4
Differential Revision: D18549
6f31554eb6
Max Khon (fjoe) · 3.95
Update to 3.95
6244bde1ca
Yuri Victorovich (yuri) · 3.94
archivers/upx: Update 3.91 -> 3.94

PR:		230089
Submitted by:	Dmitri Goutnik <dg@syrec.org>
Approved by:	fjoe (maintainer's timeout; 33 days)
88fe79d6da
Alexey Dokuchaev (danfe) · 3.91
Unbreak the build on sparc64: unlike e.g. on powerpc, gcc on sparc64 does not provide __BIG_ENDIAN__ macro by default.  As `archivers/upx' is aware of sparc64 existence, simply tell it that it is big-endian architecture. While here, vocalize installation commands.
7f47139301
Mathieu Arnold (mat) · 3.91
Cleanup patches, a* categories.

Rename them to follow the make makepatch naming, and regenerate them.

With hat:	portmgr
Sponsored by:	Absolight
9fa9eb9ac7
Mathieu Arnold (mat) · 3.91
Remove ${PORTSDIR}/ from dependencies, Mk and categories a, b, and c.

With hat:	portmgr
Sponsored by:	Absolight
7f4572eae4
John Marino (marino) · 3.91
archivers/upx: Expand patch to support malloc.h-less DF
38eb8b7cf2
Mathieu Arnold (mat) · 3.91
Cleanup DIST* variables.

When appropriate:
- Try to use DISTVERSION{SUF,PRE}FIX
- Replace PORTNAME-PORTVERSION by DISTNAME
- Convert MASTER_SITES to use macros
- Other light cleanup

With hat:	portmgr
Sponsored by:	Absolight
88bfe4bd43
Adam Weinberger (adamw) · 3.91
Add DOCS to OPTIONS_DEFINE where PORTDOCS= is set.
cff70035fd
Olli Hauer (ohauer) · 3.91
- fix sanity in CAT archivers  - USE_BZIP2   -> USES=tar:bzip2  - LICENSE=BSD -> BSD[n]CLAUSE
73969bbf79
Max Khon (fjoe) · 3.91
Update to 3.91

PR:		185276
Submitted by:	Wesley Shields
6be8465325
Baptiste Daroussin (bapt) · 3.09
Support stage
f6dbeb2e35
Baptiste Daroussin (bapt) · 3.09
In preparation for making libtool generate libraries with a sane name, fix all LIB_DEPENDS in accessibility

With hat:	portmgr
b3a96ed6ee
Baptiste Daroussin (bapt) · 3.09
Add NO_STAGE all over the place in preparation for the staging support (cat: archivers)
b80ec3e204
Baptiste Daroussin (bapt) · 3.09
Convert archivers from USE_GMAKE to USES=gmake While here: - Trim headers - Convert some port to the new perl world - Convert some port from USE_GNOME=pkgconfig to USES=pkgconfig
ecfa41e79d
Max Khon (fjoe) · 3.09
Update to 3.09.

PR:		180223
Submitted by:	Devil <devzone.my@gmail.com>
7a6e4cb54a
Max Khon (fjoe) · 3.08
Fix build on ia64.
7a71d56e23
Max Khon (fjoe) · 3.08
Update to 3.08

PR:		163856
Submitted by:	sunpoet@
2c9a5b4b8b
Martin Wilke (miwi) · 3.07
- Get Rid MD5 support

With hat:	portmgr (myself)
65e190c0f0
Max Khon (fjoe) · 3.07
Update to 3.0.7.
94d247fd2d
Max Khon (fjoe) · 3.05
Update to upx 3.05 and lzma from 7zip 4.65

PR:		146216
44663dfe28
Max Khon (fjoe) · 3.04
Update to 3.04.

PR:		140182
Submitted by:	Emanuel Haupt
860556ae06
page 1 of 2older →oldest »