CriticalFix available
minidlna — security advisory
ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This results in other code later using attacker-controlled chunk values that exceed the length of the allocated buffer, resulting in out-of-bounds read/write.
- Products
- minidlna
- Affected versions
- 1.3.0+dfsg-2.2
- Fixed versions
- 1.3.0+dfsg-2.2+deb12u1, 1.3.2+dfsg-1.1
- CVEs
- CVE-2023-33476
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 15:53 UTC · Revision 1
Source evidence
ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This results in other code later using attacker-controlled chunk values that exceed the length of the allocated buffer, resulting in out-of-bounds read/write.
osv:DEBIAN-CVE-2023-33476
minidlna
Fixed versions: 1.3.0+dfsg-2.2+deb12u1
minidlna
Fixed versions: 1.3.2+dfsg-1.1
minidlna
Fixed versions: 1.3.2+dfsg-1.1
Complete source record
{
"id": "d7be9883116e4f178ba44ae854461118401c28d8472bfa07effb65d1a2bef3ac",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2023-33476",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2023-33476",
"summary": "ReadyMedia (MiniDLNA) versions from 1.1.15 up to 1.3.2 is vulnerable to Buffer Overflow. The vulnerability is caused by incorrect validation logic when handling HTTP requests using chunked transport encoding. This results in other code later using attacker-controlled chunk values that exceed the length of the allocated buffer, resulting in out-of-bounds read/write.",
"evidence": "osv:DEBIAN-CVE-2023-33476",
"products": [
{
"name": {
"value": "minidlna",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.3.0+dfsg-2.2+deb12u1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": [
{
"value": "1.3.0+dfsg-2.2",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "minidlna",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.3.2+dfsg-1.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "minidlna",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.3.2+dfsg-1.1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "critical",
"structured": {
"id": "DEBIAN-CVE-2023-33476",
"aliases": [
"DEBIAN-CVE-2023-33476"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.0+dfsg-2.2+deb12u1"
}
]
}
],
"package": {
"name": "minidlna",
"purl": "pkg:deb/debian/minidlna?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1.3.0+dfsg-2.2"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-33476.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2+dfsg-1.1"
}
]
}
],
"package": {
"name": "minidlna",
"purl": "pkg:deb/debian/minidlna?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-33476.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.3.2+dfsg-1.1"
}
]
}
],
"package": {
"name": "minidlna",
"purl": "pkg:deb/debian/minidlna?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-33476.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-26T18:02:17.043102884Z",
"provider": "osv",
"upstream": [
"CVE-2023-33476"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2023-33476"
]
},
"related_cves": [
{
"value": "CVE-2023-33476",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 455941,
"published_at": "2023-06-02T14:15:09.437+00:00"
}