What’s Vulnerable › Vulnerabilities

CVE-2017-1000494

• Severity: high (CVSS 7.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-01-03 · updated 2026-06-17
• Weakness: CWE-119

Description

Uninitialized stack variable vulnerability in NameValueParserEndElt (upnpreplyparse.c) in miniupnpd < 2.0 allows an attacker to cause Denial of Service (Segmentation fault and Memory Corruption) or possibly have unspecified other impact

Affected products

• miniupnp project miniupnpd: before 2.0 — fixed in 2.0

How to fix

Upgrade to a fixed version: miniupnp project miniupnpd 2.0. Check the vendor advisory for mitigations.

References

• https://github.com/miniupnp/miniupnp/commit/7aeb624b44f86d335841242ff427433190e7168a
• https://github.com/miniupnp/miniupnp/issues/268
• https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html
• https://usn.ubuntu.com/3562-1/
• https://github.com/miniupnp/miniupnp/commit/7aeb624b44f86d335841242ff427433190e7168a
• https://github.com/miniupnp/miniupnp/issues/268
• https://lists.debian.org/debian-lts-announce/2019/05/msg00045.html
• https://usn.ubuntu.com/3562-1/

Get alerted when CVE-2017-1000494 or the next vulnerability affects your stack