CVE-2017-5545
libplist: Out-of-bounds heap buffer read in plistutil
Sévérité par source
Le label propre à Trivy est CRITICAL. Critique selon NVD. Plus basse selon Red Hat (faible).
Description
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 11 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 12 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 13 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 14 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 7 | libplist | 1.8-1+deb7u1 |
| debian 8 | libplist | 1.11-3+deb8u1 |
| echo | libplist | 1.12+git+1+e37ca00-0.1 |
| Red Hat | libplist, libplist-devel, libplist-python | pas de correctif indiqué |
Afficher les 10 entrées de 8 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| debian 11 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 12 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 13 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 14 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 7 | libplist | 1.8-1+deb7u1 |
| debian 8 | libplist | 1.11-3+deb8u1 |
| echo | libplist | 1.12+git+1+e37ca00-0.1 |
| Red Hat | libplist | pas de correctif indiqué |
| Red Hat | libplist-devel | pas de correctif indiqué |
| Red Hat | libplist-python | pas de correctif indiqué |
Références
- http://www.securityfocus.com/bid/95702
- https://access.redhat.com/security/cve/CVE-2017-5545
- https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee
- https://github.com/libimobiledevice/libplist/issues/87
- https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-5545
- https://www.cve.org/CVERecord?id=CVE-2017-5545