CVE-2017-8798
Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v ...
Severity by source
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Ubuntu (medium).
Description
Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.6 | miniupnpc | 2.0-r1 |
| debian 11 | miniupnpc | 1.9.20140610-3 |
| debian 12 | miniupnpc | 1.9.20140610-3 |
| debian 13 | miniupnpc | 1.9.20140610-3 |
| debian 14 | miniupnpc | 1.9.20140610-3 |
| debian 7 | miniupnpc | 1.5-2+deb7u2 |
| debian 8 | miniupnpc | 1.9.20140610-2+deb8u2 |
| echo | miniupnpc | 1.9.20140610-3 |
| ubuntu 14.04 | miniupnpc | 1.6-3ubuntu2.14.04.3 |
| ubuntu 16.04 | miniupnpc | 1.9.20140610-2ubuntu2.16.04.1 |
| ubuntu 16.04-ESM | miniupnpc | 1.9.20140610-2ubuntu2.16.04.1 |
| ubuntu 16.10 | miniupnpc | 1.9.20140610-2ubuntu2.16.10.1 |
Show all 13 entries from 13 sources
| Source | Package | Fixed in |
|---|---|---|
| alpine 3.6 | miniupnpc | 2.0-r1 |
| debian 11 | miniupnpc | 1.9.20140610-3 |
| debian 12 | miniupnpc | 1.9.20140610-3 |
| debian 13 | miniupnpc | 1.9.20140610-3 |
| debian 14 | miniupnpc | 1.9.20140610-3 |
| debian 7 | miniupnpc | 1.5-2+deb7u2 |
| debian 8 | miniupnpc | 1.9.20140610-2+deb8u2 |
| echo | miniupnpc | 1.9.20140610-3 |
| ubuntu 14.04 | miniupnpc | 1.6-3ubuntu2.14.04.3 |
| ubuntu 16.04 | miniupnpc | 1.9.20140610-2ubuntu2.16.04.1 |
| ubuntu 16.04-ESM | miniupnpc | 1.9.20140610-2ubuntu2.16.04.1 |
| ubuntu 16.10 | miniupnpc | 1.9.20140610-2ubuntu2.16.10.1 |
| ubuntu 17.04 | miniupnpc | 1.9.20140610-2ubuntu2.17.04.1 |
References
- http://miniupnp.free.fr/files/changelog.php?file=miniupnpc-2.0.20170509.tar.gz
- https://github.com/tintinweb/pub/blob/master/pocs/cve-2017-8798/Readme.md
- https://github.com/tintinweb/pub/tree/master/pocs/cve-2017-8798
- https://lists.debian.org/debian-lts-announce/2020/04/msg00027.html
- https://ubuntu.com/security/notices/USN-3298-1
- https://ubuntu.com/security/notices/USN-3298-2
- https://www.cve.org/CVERecord?id=CVE-2017-8798