1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 3379-1] miniupnpc security update

    From Salvatore Bonaccorso@1:229/2 to All on Sun Oct 25 13:40:02 2015
    From: [email protected]

    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-3379-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso October 25, 2015 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : miniupnpc
    CVE ID : CVE-2015-6031
    Debian Bug : 802650

    Aleksandar Nikolic of Cisco Talos discovered a buffer overflow
    vulnerability in the XML parser functionality of miniupnpc, a UPnP IGD
    client lightweight library. A remote attacker can take advantage of this
    flaw to cause an application using the miniupnpc library to crash, or potentially to execute arbitrary code with the privileges of the user
    running the application.

    For the oldstable distribution (wheezy), this problem has been fixed
    in version 1.5-2+deb7u1.

    For the stable distribution (jessie), this problem has been fixed in
    version 1.9.20140610-2+deb8u1.

    For the unstable distribution (sid), this problem will be fixed soon.

    We recommend that you upgrade your miniupnpc packages.

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: [email protected]
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1

    iQIcBAEBCgAGBQJWLM0IAAoJEAVMuPMTQ89EcZcP/31jm2VXXuvZde4soGi3GE/Z ZkXb1vUPb3kNY2KgtZvcMtzx78Ma6aY3zykmbfH9kwcbaEWHZ3CYXGC7zdWaFJMP J2UpzJl5gPUlniNj1Kn9qQDKP4HM5pV3ZmxHmjZL4gtmdtsY9QujDh1wR23g/2be rqnwKJNxEivYlElHEMPqvfYQ/ZVIOUQclTnVetGgEU6lPSrluhMF82cCZXg0z58w wGMKJhYz6qDxhnG4D2166yiwBnoDtQFuKFRJ0ehGWGjJSc1zMuBfyM3ZCNHTjezJ 7ZWvXBNUFK6prrRphFz4767CTQWQy4EqMSncz6QpZGi70D83gpv4fNnts+T8Tqfw 9yEtdsZ/VYJOymsb/CsKRp1L3GG/3+MDfGSsb4nPW8lxMvGsqxxNyRozxL3HbzVy gY0EmRL7ctCY9GHEP0AA6/7iwyUbVPFLYgAMIW+SN2QiR0c9EZuw6Mai7U9WCAHH kXCpmx7EKG6goa7qmHFsVf3r78mSL7DeWhhoQyGipdUUjS8Un5ilKdemQDbfhsdW HP9WfeP6t1bBsWOldSuK8SWOzgPxYx7A/3SYaHAFBriNd5ID0EBcR9QE0nT7DO5L qZunHrkXWtcETlSZlkzZsUmj4AmcnJzb4jRV40fWrp1FdgdL7Q5BiVmtQb/8fElk NFToSjHR1dmX005bhRAZ
    =5ENd
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: you cannot sedate... all the things you hate (1:229/2)