CVE-2023-33476
- State
- Published
- Severity
- 9.8 Critical
- Published
- Jun 2, 2023
- Updated
- Jan 8, 2025
- Reserved
- May 22, 2023
Description
ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This results in other code later using attacker-controlled chunk values that exceed the length of the allocated buffer, resulting in out-of-bounds read/write.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 9.8 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-787 Out-of-bounds Write
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- https://sourceforge.net/projects/minidlna/
- https://blog.coffinsec.com/0day/2023/05/31/minidlna-heap-overflow-rca.html
- https://sourceforge.net/p/minidlna/git/ci/9bd58553fae5aef3e6dd22f51642d2c851225aec/
- [debian-lts-announce] 20230621 [SECURITY] [DLA 3465-1] minidlna security updatemailing-list
- DSA-5434vendor-advisory
- GLSA-202311-12vendor-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.