CVE-2016-6255
CVE-2016-6255
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.
CVSS 7.5 · High · EPSS 27.0% · Public exploit · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
libupnp Ubuntu:14.04:LTS
- Versions
- 1:1.6.17-1.2
- Affected ranges
- ECOSYSTEM: < 1:1.6.17-1.2+deb7u1build0.14.04.1
Update to 1:1.6.17-1.2+deb7u1build0.14.04.1
libupnp Ubuntu:Pro:16.04:LTS
- Versions
- 1:1.6.19+git20141001-1
- 1:1.6.19+git20141001-1ubuntu1
- 1:1.6.19+git20160116-1
- Affected ranges
- ECOSYSTEM: < 1:1.6.19+git20160116-1ubuntu0.1~esm1
Update to 1:1.6.19+git20160116-1ubuntu0.1~esm1
Original sources
- http://www.openwall.com/lists/oss-security/2016/07/20/5
- https://twitter.com/mjg59/status/755062278513319936
- https://github.com/mjg59/pupnp-code/commit/be0a01bdb83395d9f3a5ea09c1308a4f1a972cbd
- https://sourceforge.net/p/pupnp/code/ci/master/tree/ChangeLog
- https://security.gentoo.org/glsa/201701-52
- https://www.exploit-db.com/exploits/40589/
- https://www.tenable.com/security/research/tra-2017-10
- http://www.openwall.com/lists/oss-security/2016/07/18/13
- http://www.debian.org/security/2016/dsa-3736
- http://www.securityfocus.com/bid/92050
- https://nvd.nist.gov/vuln/detail/CVE-2016-6255