Red Hat Bugzilla – Bug 1270841
CVE-2015-6031 miniupnpc: Buffer overflow vulnerability in XML parser functionality
Last modified: 2015-10-25 13:34:28 EDT
A buffer overflow vulnerability was found in the XML parser functionality of MiniUPnP library. A specially crafted XML response can lead to a buffer overflow on the stack resulting in remote code execution. An attacker can set up a server on the local network to trigger this vulnerability. Buffer overflow is present in client-side, miniupnpc, part of the library. Vulnerable part of the code is triggered when applications using miniupnpc library are doing initial network discovery upon startup, while parsing the replies from UPNP servers on the local network. Buffer overflow is triggered by an oversized XML element name.
More info can be found here:
Created miniupnpc tracking bugs for this issue:
Affects: fedora-all [bug 1270842]