CVE-2016-3178: Medium severity miniupnp vulnerability
Published Mar 4, 2016
·Updated
The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (out-of-bounds memory access and daemon crash) via vectors involving a negative length value.
Affected Software
3 affected componentsFixes available
debian/minissdpd<=1.1.20120121-1, <=1.2.20130907-3
1.2.20130907-3.21.2.20130907-3+deb8u1
debian/minissdpd
1.5.20190824-11.6.0-11.6.0-2
Miniupnp Project Minissdpd=1.2.20130907-3
Remediation
Patch Available
Patch Available
Patch Available
Event History
Mar 4, 2016
Data Sourced
via Debian·10:24 PM
SeverityAffected Software
Mar 24, 2017
CVE Published
via MITRE·03:00 PM
Data Sourced
via MITRE·03:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2016-3178?
CVE-2016-3178 has a severity rating that indicates it can lead to a denial of service due to out-of-bounds memory access.
2
How do I fix CVE-2016-3178?
To fix CVE-2016-3178, update to MiniSSDPd versions 1.5.20190824-1, 1.6.0-1, or later.
3
Which versions of MiniSSDPd are affected by CVE-2016-3178?
MiniSSDPd versions up to and including 1.2.20130907-3 are affected by CVE-2016-3178.
4
Can CVE-2016-3178 be exploited by local users?
Yes, local users can exploit CVE-2016-3178 to cause a denial of service by manipulating the processRequest function.
5
What vulnerability type is CVE-2016-3178?
CVE-2016-3178 is categorized as a denial of service vulnerability.