cbcvebase.
CVE-2019-12106
published 2019-05-15

CVE-2019-12106: The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability.

PriorityP337high7.5CVSS 3.0
AVNACLPRNUINSUCNINAH
EPSS
2.83%
84.8th percentile
The updateDevice function in minissdpd.c in MiniUPnP MiniSSDPd 1.4 and 1.5 allows a remote attacker to crash the process due to a Use After Free vulnerability.

Affected

7 ranges
VendorProductVersion rangeFixed in
debianminissdpd< minissdpd 1.5.20190210-1 (bookworm)minissdpd 1.5.20190210-1 (bookworm)
miniupnp_projectminissdpd>= 0 < 1.5.20190210-11.5.20190210-1
miniupnp_projectminissdpd>= 0 < 1.5.20190210-11.5.20190210-1
miniupnp_projectminissdpd>= 0 < 1.5.20190210-11.5.20190210-1
miniupnp_projectminissdpd>= 0 < 1.5.20190210-11.5.20190210-1
miniupnp_projectminiupnpd——
miniupnp_projectminiupnpd——

CVSS provenance

nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.