Unrated severityNVD Advisory· Published Nov 2, 2015· Updated May 6, 2026
CVE-2015-6031
CVE-2015-6031
Description
Buffer overflow in the IGDstartelt function in igd_desc_parse.c in the MiniUPnP client (aka MiniUPnPc) before 1.9.20150917 allows remote UPNP servers to cause a denial of service (application crash) and possibly execute arbitrary code via an "oversized" XML element name.
Affected products
30cpe:2.3:a:miniupnp_project:miniupnpc:*:*:*:*:*:*:*:*+ 21 more
- cpe:2.3:a:miniupnp_project:miniupnpc:*:*:*:*:*:*:*:*range: <=1.9
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-02-03:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-02-05:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-05-15:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-06-10:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-07-01:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-09-06:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-09-11:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-11-05:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-11-13:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2014-11-17:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-04-27:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-04-30:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-05-22:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-06-16:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-07-15:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-07-22:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-07-23:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-08-16:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-08-27:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-08-28:*:*:*:*:*:*
- cpe:2.3:a:miniupnp_project:miniupnpc:1.9:2015-09-15:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*+ 2 more
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:15.04:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
9- talosintel.com/reports/TALOS-2015-0035/nvdExploit
- lists.opensuse.org/opensuse-updates/2015-11/msg00122.htmlnvdMailing ListThird Party Advisory
- www.debian.org/security/2015/dsa-3379nvdThird Party Advisory
- www.securityfocus.com/bid/77306nvdThird Party AdvisoryVDB Entry
- www.ubuntu.com/usn/USN-2780-1nvdThird Party Advisory
- www.ubuntu.com/usn/USN-2780-2nvdThird Party Advisory
- github.com/miniupnp/miniupnp/blob/master/miniupnpc/Changelog.txtnvdThird Party Advisory
- github.com/miniupnp/miniupnp/commit/79cca974a4c2ab1199786732a67ff6d898051b78nvdThird Party Advisory
- security.gentoo.org/glsa/201801-08nvdThird Party Advisory
News mentions
0No linked articles in our index yet.