CVE-2014-3985
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a...
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
Exploit likelihood
What each source reports
NVD Score used
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
- Record
CVE-2014-3985- CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
- Record
CVE-2014-3985- Updated
- 2026-11-02
EUVDEUVD-2014-3918 No score
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
- Record
EUVD-2014-3918- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jwgg-6gv4-m9cx No score
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a...
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
- Record
GHSA-jwgg-6gv4-m9cx- Updated
- 2026-11-02
OSV No score
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
- Record
CVE-2014-3985- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-3985 No score
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
- Record
DEBIAN-CVE-2014-3985- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10434-1 No score
libminiupnpc-devel-2.0-1.5 on GA media
These are all security issues fixed in the libminiupnpc-devel-2.0-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10434-1- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-3985 No score
The getHTTPResponse function in miniwget.c in MiniUPnP 1.9 allows remote attackers to cause a denial of service (crash) via crafted headers that trigger an out-of-bounds read.
- Record
UBUNTU-CVE-2014-3985- Updated
- 2026-11-02
OSVUSN-2280-1 No score
miniupnpc vulnerability
It was discovered that MiniUPnPc incorrectly handled certain buffer lengths. A remote attacker could possibly use this issue to cause applications using MiniUPnPc to crash, resulting in a denial of service.
- Record
USN-2280-1- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-3985 is a medium vulnerability (CVSS 5.0) in Miniupnp Project Miniupnp, published June 9, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.31%, the 88th percentile. Fixed in miniupnpc 1.6-4.
References
securityfocus.com/bid/67152
lists.opensuse.org/opensuse-updates/2014-06/msg00039.html
security.gentoo.org/glsa/201701-41
github.com/miniupnp/miniupnp/commit/3a87aa2f10bd7f1408e1849bdb59c41dd63a9fe9
seclists.org/oss-sec/2014/q2/201
bugzilla.redhat.com/show_bug.cgi?id=1085618
Show 9 moreShow less
nvd.nist.gov/vuln/detail/CVE-2014-3985
security-tracker.debian.org/tracker/CVE-2014-3985
ubuntu.com/security/CVE-2014-3985
openwall.com/lists/oss-security/2014/04/30/3
cve.org/CVERecord?id=CVE-2014-3985
suse.com/security/cve/CVE-2014-3985