NA

CVE-2023-33476

Published: 02/06/2023 Updated: 25/11/2023
CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9
VMScore: 0

Vulnerability Summary

ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This results in other code later using attacker-controlled chunk values that exceed the length of the allocated buffer, resulting in out-of-bounds read/write.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

readymedia project readymedia

Vendor Advisories

Debian Bug report logs - #1037052 minidlna: CVE-2023-33476 Package: src:minidlna; Maintainer for src:minidlna is Alexander GQ Gerasiov <gq@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 2 Jun 2023 21:27:02 UTC Severity: grave Tags: security, upstream Found in version minidlna/132+df ...
A heap-based buffer overflow vulnerability was found in the HTTP chunk parsing code of minidlna, a lightweight DLNA/UPnP-AV server, which may result in denial of service or the execution of arbitrary code For the oldstable distribution (bullseye), this problem has been fixed in version 130+dfsg-2+deb11u2 For the stable distribution (bookworm), ...

Github Repositories

Exploits for a heap overflow in MiniDLNA <=1.3.2 (CVE-2023-33476)

CVE-2023-33476 ReadyMedia (MiniDLNA) versions from 1115 up to 132 is vulnerable to Buffer Overflow The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding This results in other code later using attacker-controlled chunk values that exceed the length of the allocated buffer, resulting in out-of-bounds read/wri