CVE-2020-13848: Null Pointer Dereference

Q: What is the severity of CVE-2020-13848?

CVE-2020-13848 has a severity rating that allows remote attackers to cause a denial of service by exploiting a NULL pointer dereference.

Q: How do I fix CVE-2020-13848?

To fix CVE-2020-13848, upgrade Portable UPnP SDK to version 1.12.2 or later.

Q: What versions of libupnp are affected by CVE-2020-13848?

CVE-2020-13848 affects Portable UPnP SDK versions 1.12.1 and earlier.

Q: Which operating systems are impacted by CVE-2020-13848?

CVE-2020-13848 impacts Debian Linux version 8.0 and any software utilizing affected versions of libupnp.

Q: What is the nature of the vulnerability in CVE-2020-13848?

CVE-2020-13848 is a denial of service vulnerability resulting from a crafted SSDP message leading to a crash.

Published Jun 4, 2020

Updated

Portable UPnP SDK (aka libupnp) 1.12.1 and earlier allows remote attackers to cause a denial of service (crash) via a crafted SSDP message due to a NULL pointer dereference in the functions FindServiceControlURLPath and FindServiceEventURLPath in genlib/servicetable/servicetable.c.

Affected Software

2 affected components

Libupnp Project Libupnp<=1.12.1

Debian Debian Linux=8.0

Remediation

Patch Available

https://github.com/pupnp/pupnp/commit/c805c1de1141cb22f74c0d94dd5664bda37398e0

Event History

Jun 4, 2020

CVE Published

via MITRE·07:55 PM

Data Sourced

via MITRE·07:55 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-13848?

CVE-2020-13848 has a severity rating that allows remote attackers to cause a denial of service by exploiting a NULL pointer dereference.

How do I fix CVE-2020-13848?