CVE-2014-3985

NameCVE-2014-3985
DescriptionThe getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs748913

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
miniupnpc (PTS)buster2.1-1fixed
bullseye2.2.1-1fixed
bookworm2.2.4-1fixed
sid, trixie2.2.6-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
miniupnpcsourcewheezy(not affected)
miniupnpcsource(unstable)1.6-4low748913

Notes

[wheezy] - miniupnpc <not-affected> (Vulnerable code not present)
https://bugzilla.redhat.com/show_bug.cgi?id=1085618
https://github.com/miniupnp/miniupnp/commit/3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9
https://www.openwall.com/lists/oss-security/2014/04/30/3

Search for package or bug name: Reporting problems