| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| libupnp-22.1.5.tar.bz2 | 2026-09-25 | 788.1 kB | |
| libupnp-22.1.5.tar.bz2.sha256 | 2026-09-25 | 89 Bytes | |
| README.md | 2026-09-25 | 1.1 kB | |
| release-22.1.5 source code.tar.gz | 2026-09-25 | 893.0 kB | |
| release-22.1.5 source code.zip | 2026-09-25 | 1.1 MB | |
| Totals: 5 Items | 2.8 MB | 0 | |
Security fix
- GHSA-ggw2-jjv9-h22c: Fix SID matching for incoming GENA
NOTIFYrequests. The control point compared theSIDheader withmemcmp()over the header's length, without checking it against the length of the stored SID. A SID made of the stored one, a NUL byte and padding read past the end of the stored string (CWE-125), and any prefix of the stored SID, such asuuid:, matched the subscription, so events could be injected without knowing the SID. The lengths must now be equal before the bytes are compared. Only control points are affected.
Pushed directly to main (commits b17de286, 0aa5332c, 59b6de61)
ahead of this release. The advisory will be published shortly.
What's Changed
- build: remove the obsolete RPM spec file by @mrjimenez in https://github.com/pupnp/pupnp/pull/639
- build: remove the Qt Creator project and move the VS Code tasks to CMake by @mrjimenez in https://github.com/pupnp/pupnp/pull/640
Full Changelog: https://github.com/pupnp/pupnp/compare/release-22.1.4...release-22.1.5