CVE-2016-6255

HIGH 7.5CVE-2016-6255 · Published 07/03/2017 · updated 17/06/2026

Package	Affected versions	Patched versions
libupnp libupnp_project	`≤ 1.6.20`	No fix yet

Description

Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.

References

debian.org/security/2016/dsa-3736 · Third Party Advisory
openwall.com/lists/oss-security/2016/07/18/13 · Mailing List
openwall.com/lists/oss-security/2016/07/20/5 · Mailing List
securityfocus.com/bid/92050 · Third Party Advisory
mjg59/pupnp-code commit be0a01b · Issue Tracking
security.gentoo.org/glsa/201701-52
sourceforge.net/p/pupnp/code/ci/master/tree/ChangeLog · Release Notes
twitter.com/mjg59/status/755062278513319936 · Third Party Advisory
exploit-db.com/exploits/40589
tenable.com/security/research/tra-2017-10

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free