From 01b07b7e020b9a5809980a3c85fd5ef73c9a354e Mon Sep 17 00:00:00 2001 From: Lewis Cook Date: Tue, 6 Apr 2021 23:46:50 +0100 Subject: security/vuxml: Document upnp stack overflow vulnerability Approved by: fernape (mentor) Differential Revision: https://reviews.freebsd.org/D29618 --- security/vuxml/vuln.xml | 30 ++++++++++++++++++++++++++++++ 1 file changed, 30 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 6587e1795852..4258c7cae6a7 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -178,6 +178,36 @@ Notes: + + upnp -- stack overflow vulnerability + + + upnp + 1.14.5,1 + + + + +

Mitre reports:

+
+ A stack overflow in pupnp 1.16.1 can cause the denial of service through the + Parser_parseDocument() function. ixmlNode_free() will release a child node + recursively, which will consume stack space and lead to a crash. +
+

+ + + + CVE-2021-28302 + https://github.com/pupnp/pupnp/issues/249 + + + 2021-03-12 + 2021-04-06 + + + ruby -- XML round-trip vulnerability in REXML -- cgit v1.2.3