CVE-2017-5545
libplist: Out-of-bounds heap buffer read in plistutil
Severidad por fuente
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD. Más baja según Red Hat (baja).
Descripción
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 12 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 13 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 14 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 7 | libplist | 1.8-1+deb7u1 |
| debian 8 | libplist | 1.11-3+deb8u1 |
| echo | libplist | 1.12+git+1+e37ca00-0.1 |
| Red Hat | libplist, libplist-devel, libplist-python | sin corrección indicada |
Mostrar las 10 entradas de 8 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| debian 11 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 12 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 13 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 14 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 7 | libplist | 1.8-1+deb7u1 |
| debian 8 | libplist | 1.11-3+deb8u1 |
| echo | libplist | 1.12+git+1+e37ca00-0.1 |
| Red Hat | libplist | sin corrección indicada |
| Red Hat | libplist-devel | sin corrección indicada |
| Red Hat | libplist-python | sin corrección indicada |
Referencias
- http://www.securityfocus.com/bid/95702
- https://access.redhat.com/security/cve/CVE-2017-5545
- https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee
- https://github.com/libimobiledevice/libplist/issues/87
- https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-5545
- https://www.cve.org/CVERecord?id=CVE-2017-5545