CVE-2016-3178

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-03-24 · updated 2026-06-17
Weakness: CWE-125

Description

The processRequest function in minissdpd.c in MiniSSDPd 1.2.20130907-3 allows local users to cause a denial of service (out-of-bounds memory access and daemon crash) via vectors involving a negative length value.

Affected products

miniupnp project Minissdpd: 1.2.20130907-3

References

http://speirofr.appspot.com/files/advisory/SPADV-2016-02.md
http://www.openwall.com/lists/oss-security/2016/03/16/13
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816759
https://github.com/miniupnp/miniupnp/commit/b238cade9a173c6f751a34acf8ccff838a62aa47
http://speirofr.appspot.com/files/advisory/SPADV-2016-02.md
http://www.openwall.com/lists/oss-security/2016/03/16/13
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=816759
https://github.com/miniupnp/miniupnp/commit/b238cade9a173c6f751a34acf8ccff838a62aa47

Get alerted when CVE-2016-3178 or the next vulnerability affects your stack