cve-2012-5958

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright © Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/vex/2012/cve-2012-5958.json"
      }
    ],
    "title": "libupnp: Multiple stack-based buffer overflows in unique_service_name() by processing specially-crafted SSDP request (VU#922681)",
    "tracking": {
      "current_release_date": "2025-11-21T12:47:09+00:00",
      "generator": {
        "date": "2025-11-21T12:47:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.6.12"
        }
      },
      "id": "CVE-2012-5958",
      "initial_release_date": "2012-01-01T00:00:00+00:00",
      "revision_history": [
        {
          "date": "2012-01-01T00:00:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2025-04-11T01:08:50+00:00",
          "number": "2",
          "summary": "Current version"
        },
        {
          "date": "2025-11-21T12:47:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "category": "vendor",
        "name": "Red Hat",
        "product": {
          "name": "All currently supported Red Hat products",
          "product_id": "red_hat_products",
          "product_identification_helper": {
            "cpe": "cpe:/a:redhat"
          }
        }
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2012-5958",
      "discovery_date": "2012-12-04T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "red_hat_products"
          ]
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Stack-based buffer overflow in the unique_service_name function in ssdp/ssdp_server.c in the SSDP parser in the portable SDK for UPnP Devices (aka libupnp, formerly the Intel SDK for UPnP devices) before 1.6.18 allows remote attackers to execute arbitrary code via a UDP packet with a crafted string that is not properly handled after a certain pointer subtraction.",
          "title": "Vulnerability description"
        },
        {
          "category": "other",
          "text": "Not vulnerable.  This issue did not affect GUPnP, which is an independent implementation of the UPnP standard, entirely different from libupnp. libupnp, while affected, is not provided by any version of Red Hat Enterprise Linux.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "known_not_affected": [
          "red_hat_products"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-5958"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-5958",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-5958"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5958",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5958"
        },
        {
          "category": "external",
          "summary": "http://www.kb.cert.org/vuls/id/922681",
          "url": "http://www.kb.cert.org/vuls/id/922681"
        }
      ],
      "release_date": "2013-01-29T00:00:00+00:00",
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 6.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "red_hat_products"
          ]
        }
      ],
      "title": "libupnp: Multiple stack-based buffer overflows in unique_service_name() by processing specially-crafted SSDP request (VU#922681)"
    }
  ]
}