Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
6.8
CVSSv2

CVE-2015-6031

Published: 02/11/2015 Updated: 18/06/2019
CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6
VMScore: 605
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
Subscribe to Miniupnpc

Vulnerability Summary

Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) prior to 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

miniupnp project miniupnpc 1.9

miniupnp project miniupnpc

debian debian linux 7.0

debian debian linux 8.0

canonical ubuntu linux 12.04

canonical ubuntu linux 14.04

canonical ubuntu linux 15.04

opensuse leap 42.1

opensuse opensuse 13.1

opensuse opensuse 13.2

Vendor Advisories

Debian CVElist Bug Report Logs: miniupnpc: CVE-2015-6031: Buffer overflow vulnerability in XML parser functionality
Debian Bug report logs - #802650 miniupnpc: CVE-2015-6031: Buffer overflow vulnerability in XML parser functionality Package: src:miniupnpc; Maintainer for src:miniupnpc is Thomas Goirand <zigo@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 22 Oct 2015 06:30:02 UTC Severity: grave Tags: ...
Ubuntu Security Notice: miniupnpc vulnerability
An application using the MiniUPnP library could be made to crash or run programs as your login if it received specially crafted network traffic ...
Ubuntu Security Notice: miniupnpc vulnerability
An application using the MiniUPnP library could be made to crash or run programs as your login if it received specially crafted network traffic ...

References

CWE-119http://www.ubuntu.com/usn/USN-2780-2https://github.com/miniupnp/miniupnp/blob/master/miniupnpc/Changelog.txthttp://www.ubuntu.com/usn/USN-2780-1http://talosintel.com/reports/TALOS-2015-0035/https://github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78http://www.debian.org/security/2015/dsa-3379http://www.securityfocus.com/bid/77306http://lists.opensuse.org/opensuse-updates/2015-11/msg00122.htmlhttps://security.gentoo.org/glsa/201801-08https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=802650https://nvd.nist.govhttps://usn.ubuntu.com/2780-1/
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2023-7028memory leaklog injectionCVE-2024-3400CVE-2022-48695CVE-2022-48675CVE-2024-34487CVE-2024-33792spoof
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook