Candidate: CVE-2016-3178
PublicDate: 2017-03-24 15:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3178
 https://speirofr.appspot.com/files/advisory/SPADV-2016-02.md
Description:
 The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3
 allows local users to cause a denial of service (out-of-bounds memory
 access and daemon crash) via vectors involving a negative length value.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816759
Priority: low
Discovered-by: Salva Peiró
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H [5.5 MEDIUM]
 nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H [5.5 MEDIUM]

Patches_minissdpd:
 upstream: https://github.com/miniupnp/miniupnp/commit/b238cade9a173c6f751a34acf8ccff838a62aa47
upstream_minissdpd: released (1.2.20130907-3+deb8u1)
precise_minissdpd: ignored (reached end-of-life)
precise/esm_minissdpd: DNE (precise was needs-triage)
trusty_minissdpd: released (1.1.20120121-1+deb7u1build0.14.04.1)
trusty/esm_minissdpd: DNE (trusty was released [1.1.20120121-1+deb7u1build0.14.04.1])
vivid/stable-phone-overlay_minissdpd: DNE
vivid/ubuntu-core_minissdpd: DNE
wily_minissdpd: ignored (reached end-of-life)
xenial_minissdpd: released (1.2.20130907-3+deb8u1build0.16.04.1)
yakkety_minissdpd: ignored (reached end-of-life)
zesty_minissdpd: ignored (reached end-of-life)
artful_minissdpd: ignored (reached end-of-life)
bionic_minissdpd: not-affected (1.5.20180223-1)
cosmic_minissdpd: not-affected (1.5.20180223-1)
devel_minissdpd: not-affected (1.5.20180223-1)