bugtraq - [SECURITY] [DSA 3379-1] miniupnpc security update

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Sun, 25 Oct 2015 12:38:19 +0000
From: Salvatore Bonaccorso <carnil@...ian.org>
To: bugtraq@...urityfocus.com
Subject: [SECURITY] [DSA 3379-1] miniupnpc security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-3379-1                   security@...ian.org
https://www.debian.org/security/                     Salvatore Bonaccorso
October 25, 2015                      https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : miniupnpc
CVE ID         : CVE-2015-6031
Debian Bug     : 802650

Aleksandar Nikolic of Cisco Talos discovered a buffer overflow
vulnerability in the XML parser functionality of miniupnpc, a UPnP IGD
client lightweight library. A remote attacker can take advantage of this
flaw to cause an application using the miniupnpc library to crash, or
potentially to execute arbitrary code with the privileges of the user
running the application.

For the oldstable distribution (wheezy), this problem has been fixed
in version 1.5-2+deb7u1.

For the stable distribution (jessie), this problem has been fixed in
version 1.9.20140610-2+deb8u1.

For the unstable distribution (sid), this problem will be fixed soon.

We recommend that you upgrade your miniupnpc packages.

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@...ts.debian.org
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWLM0IAAoJEAVMuPMTQ89EcZcP/31jm2VXXuvZde4soGi3GE/Z
ZkXb1vUPb3kNY2KgtZvcMtzx78Ma6aY3zykmbfH9kwcbaEWHZ3CYXGC7zdWaFJMP
J2UpzJl5gPUlniNj1Kn9qQDKP4HM5pV3ZmxHmjZL4gtmdtsY9QujDh1wR23g/2be
rqnwKJNxEivYlElHEMPqvfYQ/ZVIOUQclTnVetGgEU6lPSrluhMF82cCZXg0z58w
wGMKJhYz6qDxhnG4D2166yiwBnoDtQFuKFRJ0ehGWGjJSc1zMuBfyM3ZCNHTjezJ
7ZWvXBNUFK6prrRphFz4767CTQWQy4EqMSncz6QpZGi70D83gpv4fNnts+T8Tqfw
9yEtdsZ/VYJOymsb/CsKRp1L3GG/3+MDfGSsb4nPW8lxMvGsqxxNyRozxL3HbzVy
gY0EmRL7ctCY9GHEP0AA6/7iwyUbVPFLYgAMIW+SN2QiR0c9EZuw6Mai7U9WCAHH
kXCpmx7EKG6goa7qmHFsVf3r78mSL7DeWhhoQyGipdUUjS8Un5ilKdemQDbfhsdW
HP9WfeP6t1bBsWOldSuK8SWOzgPxYx7A/3SYaHAFBriNd5ID0EBcR9QE0nT7DO5L
qZunHrkXWtcETlSZlkzZsUmj4AmcnJzb4jRV40fWrp1FdgdL7Q5BiVmtQb/8fElk
NFToSjHR1dmX005bhRAZ
=5ENd
-----END PGP SIGNATURE-----