Correct status on CVE-2019-12111/miniupnpd for stretch
The copyIPv6IfDifferent helper was only introduce in https://github.com/miniupnp/miniupnp/commit/3b12b8fb4e64e90a6319ae0aef3c240a44093439 But the CVE is relating to a NULL pointer dereference in copyIPv6IfDifferent in pcpserver.c due to not checking the src argument. This is not done as well before the above upstream commit introducing the helper function, so one can argue that the CVE-2019-12111 applies to earlier versions as well. Thanks: Markus Linnala Fixes: 8888a5e5 ("Mark CVE-2019-12111/miniupnpd as not-affected")
Loading
Please register or sign in to comment