#132 CVE-2016-6255: write files via POST

[Balint Reczey]

From Debian's BTS https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=831857 :

From: Salvatore Bonaccorso carnil@debian.org
To: Debian Bug Tracking System submit@bugs.debian.org
Subject: libupnp: write files via POST
Date: Wed, 20 Jul 2016 11:03:34 +0200

Source: libupnp
Version: 1:1.6.17-1
Severity: grave
Tags: security upstream
Justification: user security hole

Hi

See http://www.openwall.com/lists/oss-security/2016/07/18/13 and
https://twitter.com/mjg59/status/755062278513319936 .

Proposed fix:
https://github.com/mjg59/pupnp-code/commit/be0a01bdb83395d9f3a5ea09c1308a4f1a972cbd

Regards,
Salvatore

[Balint Reczey]

[Thev00d00]

Any chance we can get this commited?

[Marcelo Roberto Jimenez]

Of course. It would make my life a lot simpler if github.com/mjg59 sent me a patch. A pull request on github does not seem possible, maybe he did not clone from my tree.

[Marcelo Roberto Jimenez]

Never mind, just saw it is the last commit.