CVSS: 7.5EPSS: 0%CPEs: 2EXPL: 1CVE-2019-12106
https://notcve.org/view.php?id=CVE-2019-12106
The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability. La función updateDevice en minissdpd.c en MiniUPnP MiniSSDPd versión 1.4 y versión 1.5, permite que un atacante remoto bloquee el proceso debido a una vulnerabilidad de acceso a memoria previamente liberada (User-After-Free). • https://github.com/miniupnp/miniupnp/commit/cd506a67e174a45c6a202eff182a712955ed6d6f https://lists.debian.org/debian-lts-announce/2019/05/msg00037.html https://www.vdoo.com/blog/security-issues-discovered-in-miniupnp • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2017-1000494
https://notcve.org/view.php?id=CVE-2017-1000494
Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact Vulnerabilidad de variable de pila no inicializada en NameValueParserEndElt (upnpreplyparse.c) en miniupnpd en versiones posteriores a la 2.0 permite que un atacante provoque una denegación de servicio (fallo de segmentación y corrupción de memoria) o que, posiblemente, cause otro tipo de impacto sin especificar. • https://github.com/miniupnp/miniupnp/commit/7aeb624b44f86d335841242ff427433190e7168a https://github.com/miniupnp/miniupnp/issues/268 https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html https://usn.ubuntu.com/3562-1 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 9.8EPSS: 5%CPEs: 6EXPL: 2CVE-2017-8798 – MiniUPnP MiniUPnPc < 2.0 - Remote Denial of Service
https://notcve.org/view.php?id=CVE-2017-8798
Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact. Error de entero sin signo en MiniUPnP MiniUPnPc versiónes desde la 1.4.20101221 hasta la 2.0 permite a atacantes remotos causar una denegación de servicio o posiblemente tener otro impacto no especificado. miniupnpc suffers from an integer signedness error when parsing a chunked encoded http response. • https://www.exploit-db.com/exploits/43501 http://miniupnp.free.fr/files/changelog.php?file=miniupnpc-2.0.20170509.tar.gz https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798 https://lists.debian.org/debian-lts-announce/2020/04/msg00027.html • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •