MGASA-2020-0483

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2020-0483.html
Import Source
https://advisories.mageia.org/MGASA-2020-0483.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2020-0483
Related
Published
2020-12-31T14:32:44Z
Modified
2020-12-31T13:54:47Z
Summary
Updated minidlna packages fix security vulnerabilities
Details

It was discovered that minidlna does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue (CVE-2020-12695).

Minidlna before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to the miniDLNA service using HTTP chunked encoding can lead to a signedness bug resulting in a buffer overflow in calls to memcpy/memmove (CVE-2020-28926).

References
Credits

Affected packages

Mageia:7 / minidlna

Package

Name
minidlna
Purl
pkg:rpm/mageia/minidlna?distro=mageia-7

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.1-3.1.mga7

Ecosystem specific 

{
    "section": "core"
}