CVE-2017-1000494

EUVD-2017-1607
Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
LOW
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
Affected Products (NVD)
VendorProductVersion
miniupnp_projectminiupnpd
𝑥
< 2.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
miniupnpc
bookworm
2.2.4-1
fixed
bullseye
2.2.1-1
fixed
sid
2.2.8-2
fixed
trixie
2.2.8-2
fixed
miniupnpd
bookworm
2.3.1-1
fixed
bullseye
2.2.1-1
fixed
sid
2.3.7-1
fixed
trixie
2.3.7-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
miniupnpc
artful
Fixed 1.9.20140610-4ubuntu1.1
released
bionic
Fixed 1.9.20140610-4ubuntu2
released
cosmic
Fixed 1.9.20140610-4ubuntu2
released
disco
Fixed 1.9.20140610-4ubuntu2
released
trusty
Fixed 1.6-3ubuntu2.14.04.4
released
xenial
Fixed 1.9.20140610-2ubuntu2.16.04.2
released
zesty
ignored
miniupnpd
artful
ignored
bionic
not-affected
cosmic
not-affected
disco
not-affected
trusty
dne
xenial
Fixed 1.8.20140523-4.1+deb9u1build0.16.04.1
released
zesty
ignored
Common Weakness Enumeration
References
https://github.com/miniupnp/miniupnp/commit/7aeb624b44f86d335841242ff427433190e7168a
https://github.com/miniupnp/miniupnp/issues/268
https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html
https://usn.ubuntu.com/3562-1/
https://github.com/miniupnp/miniupnp/commit/7aeb624b44f86d335841242ff427433190e7168a
https://github.com/miniupnp/miniupnp/issues/268
https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html
https://usn.ubuntu.com/3562-1/