Candidate: CVE-2016-3179
PublicDate: 2017-03-24 15:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3179
 https://speirofr.appspot.com/files/advisory/SPADV-2016-02.md
Description:
 The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3
 allows local users to cause a denial of service (invalid free and daemon
 crash) via vectors related to error handling.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816759
Priority: untriaged
Discovered-by: Salva Peiró
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H [5.5 MEDIUM]
 nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H [5.5 MEDIUM]

Patches_minissdpd:
 upstream: https://github.com/miniupnp/miniupnp/commit/140ee8d2204b383279f854802b27bdb41c1d5d1a
upstream_minissdpd: released (1.2.20130907-3+deb8u1)
precise_minissdpd: ignored (reached end-of-life)
precise/esm_minissdpd: DNE (precise was needs-triage)
trusty_minissdpd: released (1.1.20120121-1+deb7u1build0.14.04.1)
trusty/esm_minissdpd: DNE (trusty was released [1.1.20120121-1+deb7u1build0.14.04.1])
vivid/stable-phone-overlay_minissdpd: DNE
vivid/ubuntu-core_minissdpd: DNE
wily_minissdpd: ignored (reached end-of-life)
xenial_minissdpd: released (1.2.20130907-3+deb8u1build0.16.04.1)
yakkety_minissdpd: ignored (reached end-of-life)
zesty_minissdpd: ignored (reached end-of-life)
artful_minissdpd: ignored (reached end-of-life)
bionic_minissdpd: not-affected (1.5.20180223-1)
cosmic_minissdpd: not-affected (1.5.20180223-1)
devel_minissdpd: not-affected (1.5.20180223-1)