CVE-2017-1000494

Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 39%
VendorProductVersion
miniupnp_projectminiupnpd
𝑥
< 2.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
miniupnpc
bullseye
2.2.1-1
fixed
bookworm
2.2.4-1
fixed
sid
2.2.8-2
fixed
trixie
2.2.8-2
fixed
miniupnpd
bullseye
2.2.1-1
fixed
bookworm
2.3.1-1
fixed
sid
2.3.7-1
fixed
trixie
2.3.7-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
miniupnpc
disco
Fixed 1.9.20140610-4ubuntu2
released
cosmic
Fixed 1.9.20140610-4ubuntu2
released
bionic
Fixed 1.9.20140610-4ubuntu2
released
artful
Fixed 1.9.20140610-4ubuntu1.1
released
zesty
ignored
xenial
Fixed 1.9.20140610-2ubuntu2.16.04.2
released
trusty
Fixed 1.6-3ubuntu2.14.04.4
released
miniupnpd
disco
not-affected
cosmic
not-affected
bionic
not-affected
artful
ignored
zesty
ignored
xenial
Fixed 1.8.20140523-4.1+deb9u1build0.16.04.1
released
trusty
dne
Common Weakness Enumeration
References
https://github.com/miniupnp/miniupnp/commit/7aeb624b44f86d335841242ff427433190e7168a
https://github.com/miniupnp/miniupnp/issues/268
https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html
https://usn.ubuntu.com/3562-1/
https://github.com/miniupnp/miniupnp/commit/7aeb624b44f86d335841242ff427433190e7168a
https://github.com/miniupnp/miniupnp/issues/268
https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html
https://usn.ubuntu.com/3562-1/