CVE-2017-5545
libplist: Out-of-bounds heap buffer read in plistutil
Kaynağa göre önem derecesi
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (düşük).
Açıklama
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 12 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 13 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 14 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 7 | libplist | 1.8-1+deb7u1 |
| debian 8 | libplist | 1.11-3+deb8u1 |
| echo | libplist | 1.12+git+1+e37ca00-0.1 |
| Red Hat | libplist, libplist-devel, libplist-python | düzeltme belirtilmemiş |
8 kaynaktaki 10 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| debian 11 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 12 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 13 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 14 | libplist | 1.12+git+1+e37ca00-0.1 |
| debian 7 | libplist | 1.8-1+deb7u1 |
| debian 8 | libplist | 1.11-3+deb8u1 |
| echo | libplist | 1.12+git+1+e37ca00-0.1 |
| Red Hat | libplist | düzeltme belirtilmemiş |
| Red Hat | libplist-devel | düzeltme belirtilmemiş |
| Red Hat | libplist-python | düzeltme belirtilmemiş |
Referanslar
- http://www.securityfocus.com/bid/95702
- https://access.redhat.com/security/cve/CVE-2017-5545
- https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee
- https://github.com/libimobiledevice/libplist/issues/87
- https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html
- https://nvd.nist.gov/vuln/detail/CVE-2017-5545
- https://www.cve.org/CVERecord?id=CVE-2017-5545