Cloudanix VulnDB

CVE-2020-28926

Critical · 9.8

CVSS

9.8

EPSS

13.2%

Published

Nov 30, 2020

CISA due date

—

The record

ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to the miniDLNA service using HTTP chunked encoding can lead to a signedness bug resulting in a buffer overflow in calls to memcpy/memmove.

Affected packages

Ecosystem Package Introduced Fixed
Debian:10 minidlna 0 1.2.1+dfsg-2+deb10u1
Debian:11 minidlna 0 1.2.1+dfsg-3
Debian:12 minidlna 0 1.2.1+dfsg-3
Debian:13 minidlna 0 1.2.1+dfsg-3
Debian:9 minidlna 0 1.1.6+dfsg-1+deb9u1
Mageia:7 minidlna 0 1.2.1-3.1.mga7
SUSE:Package Hub 15 SP1 minidlna 0 1.3.0-bp151.2.3.1
SUSE:Package Hub 15 SP2 minidlna 0 1.3.0-bp152.4.3.1
Ubuntu:16.04:LTS minidlna 0 1.1.5+dfsg-2ubuntu0.1
Ubuntu:18.04:LTS minidlna 0 1.2.1+dfsg-1ubuntu0.18.04.1
Ubuntu:20.04:LTS minidlna 0 1.2.1+dfsg-1ubuntu0.20.04.1
openSUSE:Leap 15.1 minidlna 0 1.3.0-lp151.3.3.1
openSUSE:Leap 15.2 minidlna 0 1.3.0-lp152.4.3.1
openSUSE:Tumbleweed minidlna 0 1.3.0-2.7

Related vulnerabilities