CVE-2017-5545
libplist: Out-of-bounds heap buffer read in plistutil
Einstufung nach Quelle
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut Red Hat (niedrig).
Beschreibung
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 12 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 13 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 14 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 7 | libplist | 1.8-1+deb7u1 |
| debian 8 | libplist | 1.11-3+deb8u1 |
| echo | libplist | 1.12+git+1+e37ca00-0.1 |
| Red Hat | libplist, libplist-devel, libplist-python | kein Fix angegeben |
Alle 10 Einträge aus 8 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| debian 11 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 12 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 13 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 14 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 7 | libplist | 1.8-1+deb7u1 |
| debian 8 | libplist | 1.11-3+deb8u1 |
| echo | libplist | 1.12+git+1+e37ca00-0.1 |
| Red Hat | libplist | kein Fix angegeben |
| Red Hat | libplist-devel | kein Fix angegeben |
| Red Hat | libplist-python | kein Fix angegeben |
Referenzen
- http://www.securityfocus.com/bid/95702
- https://access.redhat.com/security/cve/CVE-2017-5545
- https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee
- https://github.com/libimobiledevice/libplist/issues/87
- https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-5545
- https://www.cve.org/CVERecord?id=CVE-2017-5545