Description
pupnp is an SDK for development of UPnP device and control point applications. Prior to 2.0.2, ixmlNode_compare in ixml/src/node.c passes the nullable nodeValue, namespaceURI, prefix, and localName fields directly to strcmp. Non-namespaced attributes created by ixmlDocument_createAttribute legitimately leave those fields NULL. When ixmlElement_removeAttributeNode compares two distinct attribute objects with the same nodeName through find_condition_node, the pointer-identity shortcut does not apply and the comparison dereferences NULL, causing a process crash when application handling of attacker-controlled XML reaches this path. This issue is fixed in 2.0.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pupnp | pupnp | < 2.0.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | pupnp | 1:22.1.8-2 | — |
| Debian 13 | pupnp | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | pupnp | No fix yet | — |
| Ubuntu 26.04 LTS | pupnp | No fix yet | — |
| Ubuntu 24.04 LTS | pupnp | No fix yet | — |
| Ubuntu 22.04 LTS | pupnp-1.8 | No fix yet | — |
| Ubuntu 20.04 LTS | pupnp-1.8 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | libupnp +1 | No fix yet | — |
| Ubuntu 16.04 LTS | mediatomb | No fix yet | — |
| Ubuntu Pro 16.04 LTS | libupnp | No fix yet | — |