ALT-PU-2016-2493-1
Closed vulnerabilities
Published: 2017-03-07
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-6255
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
Severity: HIGH (7.5)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
References:
- DSA-3736
- DSA-3736
- [oss-security] 20160718 libupnp write files via POST
- [oss-security] 20160718 libupnp write files via POST
- [oss-security] 20160720 Re: libupnp write files via POST
- [oss-security] 20160720 Re: libupnp write files via POST
- 92050
- 92050
- https://github.com/mjg59/pupnp-code/commit/be0a01bdb83395d9f3a5ea09c1308a4f1a972cbd
- https://github.com/mjg59/pupnp-code/commit/be0a01bdb83395d9f3a5ea09c1308a4f1a972cbd
- GLSA-201701-52
- GLSA-201701-52
- https://sourceforge.net/p/pupnp/code/ci/master/tree/ChangeLog
- https://sourceforge.net/p/pupnp/code/ci/master/tree/ChangeLog
- https://twitter.com/mjg59/status/755062278513319936
- https://twitter.com/mjg59/status/755062278513319936
- 40589
- 40589
- https://www.tenable.com/security/research/tra-2017-10
- https://www.tenable.com/security/research/tra-2017-10
Published: 2017-03-07
Modified: 2024-11-21
Modified: 2024-11-21
CVE-2016-8863
Heap-based buffer overflow in the create_url_list function in gena/gena_device.c in Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a valid URI followed by an invalid one in the CALLBACK header of an SUBSCRIBE request.
Severity: CRITICAL (9.8)
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References:
- 92849
- 92849
- GLSA-201701-52
- GLSA-201701-52
- https://sourceforge.net/p/pupnp/bugs/133/
- https://sourceforge.net/p/pupnp/bugs/133/
- https://sourceforge.net/p/pupnp/code/ci/master/tree/ChangeLog
- https://sourceforge.net/p/pupnp/code/ci/master/tree/ChangeLog
- DSA-3736
- DSA-3736
- https://www.tenable.com/security/research/tra-2017-10
- https://www.tenable.com/security/research/tra-2017-10