Skip to content
Commit cc378b4b authored by Salvatore Bonaccorso's avatar Salvatore Bonaccorso
Browse files

Correct status on CVE-2019-12111/miniupnpd for stretch

The copyIPv6IfDifferent helper was only introduce in
https://github.com/miniupnp/miniupnp/commit/3b12b8fb4e64e90a6319ae0aef3c240a44093439

But the CVE is relating to a NULL pointer dereference in
copyIPv6IfDifferent in pcpserver.c due to not checking the src argument.
This is not done as well before the above upstream commit introducing
the helper function, so one can argue that the CVE-2019-12111 applies to
earlier versions as well.

Thanks: Markus Linnala
Fixes: 8888a5e5 ("Mark CVE-2019-12111/miniupnpd as not-affected")
parent da008fe5
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment