GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

OPENSUSE-SU-2020:2160-1

Vulnerability from csaf_opensuse - Published: 2020-12-04 15:24 - Updated: 2020-12-04 15:24
Summary
Security update for minidlna
Severity
Moderate
Notes
Title of the patch: Security update for minidlna
Description of the patch: This update for minidlna fixes the following issues: minidlna was updated to version 1.3.0 (boo#1179447) - Fixed some build warnings when building with musl. - Use $USER instead of $LOGNAME for the default friendly name. - Fixed build with GCC 10 - Fixed some warnings from newer compilers - Disallow negative HTTP chunk lengths. [CVE-2020-28926] - Validate SUBSCRIBE callback URL. [CVE-2020-12695] - Fixed spurious warnings with ogg coverart - Fixed an issue with VLC where browse results would be truncated. - Fixed bookmarks on Samsung Q series - Added DSD file support. - Fixed potential stack smash vulnerability in getsyshwaddr on macOS. - Will now reload the log file on SIGHUP. - Worked around bad SearchCriteria from the Control4 Android app. - Increased max supported network addresses to 8. - Added forced alphasort capability. - Added episode season and number metadata support. - Enabled subtitles by default for unknown DLNA clients, and add enable_subtitles config option. - Fixed discovery when connected to certain WiFi routers. - Added FreeBSD kqueue support. - Added the ability to set the group to run as.
Patchnames: openSUSE-2020-2160
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2020-12695
7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 15.2:minidlna-1.3.0-lp152.4.3.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2020-28926
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Recommended 1 product, the same list as for CVE-2020-12695
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for minidlna",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for minidlna fixes the following issues:\n\nminidlna was updated to version 1.3.0 (boo#1179447)\n\n  - Fixed some build warnings when building with musl.\n  - Use $USER instead of $LOGNAME for the default friendly name.\n  - Fixed build with GCC 10\n  - Fixed some warnings from newer compilers\n  - Disallow negative HTTP chunk lengths. [CVE-2020-28926]\n  - Validate SUBSCRIBE callback URL. [CVE-2020-12695]\n  - Fixed spurious warnings with ogg coverart\n  - Fixed an issue with VLC where browse results would be truncated.\n  - Fixed bookmarks on Samsung Q series\n  - Added DSD file support.\n  - Fixed potential stack smash vulnerability in getsyshwaddr on macOS.\n  - Will now reload the log file on SIGHUP.\n  - Worked around bad SearchCriteria from the Control4 Android app.\n  - Increased max supported network addresses to 8.\n  - Added forced alphasort capability.\n  - Added episode season and number metadata support.\n  - Enabled subtitles by default for unknown DLNA clients, and add enable_subtitles config option.\n  - Fixed discovery when connected to certain WiFi routers.\n  - Added FreeBSD kqueue support.\n  - Added the ability to set the group to run as.\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-2020-2160",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2020_2160-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2020:2160-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/A2GHF3UJM6D2JSKELXMJY57IRWK3PJM3/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2020:2160-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/A2GHF3UJM6D2JSKELXMJY57IRWK3PJM3/"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1179447",
        "url": "https://bugzilla.suse.com/1179447"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-12695 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-12695/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2020-28926 page",
        "url": "https://www.suse.com/security/cve/CVE-2020-28926/"
      }
    ],
    "title": "Security update for minidlna",
    "tracking": {
      "current_release_date": "2020-12-04T15:24:02Z",
      "generator": {
        "date": "2020-12-04T15:24:02Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2020:2160-1",
      "initial_release_date": "2020-12-04T15:24:02Z",
      "revision_history": [
        {
          "date": "2020-12-04T15:24:02Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "minidlna-1.3.0-lp152.4.3.1.x86_64",
                "product": {
                  "name": "minidlna-1.3.0-lp152.4.3.1.x86_64",
                  "product_id": "minidlna-1.3.0-lp152.4.3.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 15.2",
                "product": {
                  "name": "openSUSE Leap 15.2",
                  "product_id": "openSUSE Leap 15.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:leap:15.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "minidlna-1.3.0-lp152.4.3.1.x86_64 as component of openSUSE Leap 15.2",
          "product_id": "openSUSE Leap 15.2:minidlna-1.3.0-lp152.4.3.1.x86_64"
        },
        "product_reference": "minidlna-1.3.0-lp152.4.3.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 15.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2020-12695",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-12695"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified event-subscription URL, aka the CallStranger issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:minidlna-1.3.0-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-12695",
          "url": "https://www.suse.com/security/cve/CVE-2020-12695"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1172700 for CVE-2020-12695",
          "url": "https://bugzilla.suse.com/1172700"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179447 for CVE-2020-12695",
          "url": "https://bugzilla.suse.com/1179447"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:minidlna-1.3.0-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:minidlna-1.3.0-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T15:24:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-12695"
    },
    {
      "cve": "CVE-2020-28926",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2020-28926"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "ReadyMedia (aka MiniDLNA) before versions 1.3.0 allows remote code execution. Sending a malicious UPnP HTTP request to the miniDLNA service using HTTP chunked encoding can lead to a signedness bug resulting in a buffer overflow in calls to memcpy/memmove.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 15.2:minidlna-1.3.0-lp152.4.3.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2020-28926",
          "url": "https://www.suse.com/security/cve/CVE-2020-28926"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1179447 for CVE-2020-28926",
          "url": "https://bugzilla.suse.com/1179447"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 15.2:minidlna-1.3.0-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 15.2:minidlna-1.3.0-lp152.4.3.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2020-12-04T15:24:02Z",
          "details": "important"
        }
      ],
      "title": "CVE-2020-28926"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.