CVE-2015-6031
Severity CVSS v4.0:
Pending analysis
Type:
CWE-119
Buffer Errors
Publication date:
02/11/2015
Last modified:
12/04/2025
Description
Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.
Impact
Base Score 2.0
6.80
Severity 2.0
MEDIUM
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:a:miniupnp_project:miniupnpc:*:*:*:*:*:*:*:* | 1.9 (including) | |
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-02-03:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-02-05:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-05-15:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-06-10:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-07-01:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-09-06:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-09-11:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-11-05:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-11-13:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-11-17:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-04-27:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-04-30:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-05-22:*:*:*:*:*:* | ||
cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-06-16:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page
References to Advisories, Solutions, and Tools
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00122.html
- http://talosintel.com/reports/TALOS-2015-0035/
- http://www.debian.org/security/2015/dsa-3379
- http://www.securityfocus.com/bid/77306
- http://www.ubuntu.com/usn/USN-2780-1
- http://www.ubuntu.com/usn/USN-2780-2
- https://github.com/miniupnp/miniupnp/blob/master/miniupnpc/Changelog.txt
- https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78
- https://security.gentoo.org/glsa/201801-08
- http://lists.opensuse.org/opensuse-updates/2015-11/msg00122.html
- http://talosintel.com/reports/TALOS-2015-0035/
- http://www.debian.org/security/2015/dsa-3379
- http://www.securityfocus.com/bid/77306
- http://www.ubuntu.com/usn/USN-2780-1
- http://www.ubuntu.com/usn/USN-2780-2
- https://github.com/miniupnp/miniupnp/blob/master/miniupnpc/Changelog.txt
- https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78
- https://security.gentoo.org/glsa/201801-08