FEDORA-2017-2c29702300 — security update for libupnp

stable

libupnp-1.6.21-1.fc25

FEDORA-2017-2c29702300 created by mooninite 7 years ago for Fedora 25

miniserver: fix binding to ipv6 link-local addresses
Fix out-of-bound access in create_url_list() (CVE-2016-8863)
If the error or info log files can not be created, use stderr and stdout instead.
SF Bug Tracker #132 CVE-2016-6255: write files via POST

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2017-2c29702300

This update has been submitted for testing by mooninite.

7 years ago

This update has been pushed to testing.

7 years ago

besser82 commented & provided feedback 7 years ago

karma

Works great! LGTM! =)

cserpentis commented & provided feedback 7 years ago

karma

works for me

sumantrom commented & provided feedback 7 years ago

karma

works fine

This update has been submitted for stable by bodhi.

7 years ago

This update has been pushed to stable.

7 years ago

Please login to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

None

Builds

libupnp-1.6.21-1.fc25

Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

disabled

Dates

submitted

7 years ago

in testing

7 years ago

in stable

7 years ago

BZ#1358351 libupnp: Upload arbitrary file via POST [fedora-all]

BZ#1358613 CVE-2016-6255 libupnp: Unhandled POSTs can write to the filesystem by default [fedora-all]

BZ#1388773 CVE-2016-8863 libupnp: Heap buffer overflow in the create_url_list function [fedora-all]

BZ#1405617 VLC does not see upnp resources

libupnp-1.6.21-1.fc25

Automated Test Results

None