UBUNTU-CVE-2019-12106: Use After Free

Q: Who can exploit this vulnerability?

A remote attacker can exploit it over the network without authentication or user interaction.

Q: What is the likely impact of successful exploitation?

Successful exploitation can crash the MiniSSDPd process, resulting in a denial of service. The provided severity vector indicates no stated confidentiality or integrity impact.

Q: Which MiniSSDPd versions are identified as affected?

The vulnerability is identified in MiniUPnP MiniSSDPd versions 1.4 and 1.5.

Published May 15, 2019

Updated

The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability.

Affected Software

2 affected componentsFixes available

ubuntu/minissdpd<1.2.20130907-3+deb8u2build0.16.04.1

1.2.20130907-3+deb8u2build0.16.04.1

ubuntu/minissdpd<1.5.20180223-1ubuntu0.1~esm1

1.5.20180223-1ubuntu0.1~esm1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/minissdpd to a version that resolves this vulnerability.
Fixed in 1.2.20130907-3+deb8u2build0.16.04.1
Upgrade
Upgrade ubuntu/minissdpd to a version that resolves this vulnerability.
Fixed in 1.5.20180223-1ubuntu0.1~esm1

Event History

May 15, 2019

CVE Published

via OSV·11:29 PM

Data Sourced

via OSV·11:29 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this vulnerability?

A remote attacker can exploit it over the network without authentication or user interaction.

What is the likely impact of successful exploitation?

Successful exploitation can crash the MiniSSDPd process, resulting in a denial of service. The provided severity vector indicates no stated confidentiality or integrity impact.

Which MiniSSDPd versions are identified as affected?

The vulnerability is identified in MiniUPnP MiniSSDPd versions 1.4 and 1.5.

UBUNTU-CVE-2019-12106: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this vulnerability?

What is the likely impact of successful exploitation?

Which MiniSSDPd versions are identified as affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this vulnerability?

What is the likely impact of successful exploitation?

Which MiniSSDPd versions are identified as affected?