A NULL pointer dereference vulnerability exists in the pupnp library, specifically in the ixmlNode_compare function. This function is used to compare two XML nodes, but it does not properly handle non-namespaced attributes, which can lead to a process crash when handling attacker-controlled XML. The vulnerability is caused by the ixmlNode_compare function passing nullable nodeValue, namespaceURI, prefix, [truncated]
An incomplete fix for CVE-2021-28302 in the pupnp SDK allows unauthenticated peers on the local network to crash UPnP services by supplying deeply nested XML through a SOAP request. This causes a stack overflow due to unbounded recursion in ixml DOM traversal functions. The affected versions of pupnp are less than 2.0.0, and the issue is fixed in version 2.0.0. Defenders should verify exposure of UPnP ser [truncated]
