881990 – (CVE-2014-3985) VUL-0: CVE-2014-3985: miniupnpc: possible buffer overflow

Bug 881990 (CVE-2014-3985) - VUL-0: CVE-2014-3985: miniupnpc: possible buffer overflow

Summary: VUL-0: CVE-2014-3985: miniupnpc: possible buffer overflow

Status:	VERIFIED FIXED

Alias:	CVE-2014-3985

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other openSUSE 13.1

Priority:	P3 - Medium Severity: Normal
Target Milestone:	---
Assignee:	Joop Boonen
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/99410/
Whiteboard:
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2014-06-10 09:21 UTC by Johannes Segitz
Modified:	2014-06-18 15:39 UTC (History)
CC List:	1 user (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Johannes Segitz 2014-06-10 09:21:47 UTC

Version 1.9 fixes a possible buffer overflow:

https://github.com/miniupnp/miniupnp/commit/3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1085618 
http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-3985.html
http://seclists.org/oss-sec/2014/q2/201

Comment 1 Swamp Workflow Management 2014-06-10 22:00:30 UTC

bugbot adjusting priority

Comment 2 Bernhard Wiedemann 2014-06-11 08:00:13 UTC

This is an autogenerated message for OBS integration:
This bug (881990) was mentioned in
https://build.opensuse.org/request/show/236818 13.1+12.3 / miniupnpc

Comment 3 Joop Boonen 2014-06-11 08:03:00 UTC

New packages have been build and submitted in factory and as update.

Comment 4 Bernhard Wiedemann 2014-06-11 09:00:13 UTC

This is an autogenerated message for OBS integration:
This bug (881990) was mentioned in
https://build.opensuse.org/request/show/236819 13.1+12.3 / miniupnpc

Comment 5 Bernhard Wiedemann 2014-06-13 12:00:12 UTC

This is an autogenerated message for OBS integration:
This bug (881990) was mentioned in
https://build.opensuse.org/request/show/237225 Factory / miniupnpc

Comment 6 Swamp Workflow Management 2014-06-18 12:04:44 UTC

openSUSE-SU-2014:0815-1: An update that fixes one vulnerability is now available.

Category: security (moderate)
Bug References: 881990
CVE References: CVE-2014-3985
Sources used:
openSUSE 13.1 (src):    miniupnpc-1.9-2.4.1
openSUSE 12.3 (src):    miniupnpc-1.9-2.4.1

Comment 7 Johannes Segitz 2014-06-18 15:39:05 UTC

all relevant packages were fixed