Security update for minidlna SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2022:0079-1 Final 1 1 2022-03-10T23:02:00Z current 2022-03-10T23:02:00Z 2022-03-10T23:02:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for minidlna This update for minidlna fixes the following issues: minidlna was updated to version 1.3.1 (boo#1196814) - Fixed a potential crash in SSDP request parsing. - Fixed a configure script failure on some platforms. - Protect against DNS rebinding attacks. (CVE-2022-26505) - Fix an socket leakage issue on some platforms. - Minor bug fixes. - add 'su minidlna minidlna' to the logrotate config - Added hardening to systemd service(s) (boo#1181400). - Use sysusers macros to create minidlna user - Don't hardrequire logrotate, we don't write log files anymore The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-2022-79 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VXEFRXJEYR7QPAMYNWTJIYKTVX5OEQ7O/ E-Mail link for openSUSE-SU-2022:0079-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1181400 SUSE Bug 1181400 https://bugzilla.suse.com/1196814 SUSE Bug 1196814 https://www.suse.com/security/cve/CVE-2022-26505/ SUSE CVE CVE-2022-26505 page SUSE Package Hub 15 SP3 openSUSE Leap 15.3 minidlna-1.3.1-bp153.2.3.1 minidlna-1.3.1-bp153.2.3.1 as a component of SUSE Package Hub 15 SP3 minidlna-1.3.1-bp153.2.3.1 as a component of openSUSE Leap 15.3 A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files. CVE-2022-26505 SUSE Package Hub 15 SP3:minidlna-1.3.1-bp153.2.3.1 openSUSE Leap 15.3:minidlna-1.3.1-bp153.2.3.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/VXEFRXJEYR7QPAMYNWTJIYKTVX5OEQ7O/ https://www.suse.com/security/cve/CVE-2022-26505.html CVE-2022-26505 https://bugzilla.suse.com/1196814 SUSE Bug 1196814