Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
14 vulnerabilities found for libplist by libimobiledevice
CVE-2015-10082 (GCVE-0-2015-10082)
Vulnerability from cvelistv5 – Published: 2023-02-21 07:00 – Updated: 2024-08-06 08:58
VLAI
Title
UIKit0 libplist XML xplist.c plist_from_xml xml external entity reference
Summary
A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The patch is named c086cb139af7c82845f6d565e636073ff4b37440. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221499.
Severity
5.5 (Medium)
5.5 (Medium)
CWE
- CWE-611 - XML External Entity Reference
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.221499 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.221499 | signaturepermissions-required |
| https://github.com/UIKit0/libplist/commit/c086cb1… | patch |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:58:26.353Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.221499"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.221499"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/UIKit0/libplist/commit/c086cb139af7c82845f6d565e636073ff4b37440"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"modules": [
"XML Handler"
],
"product": "libplist",
"vendor": "UIKit0",
"versions": [
{
"status": "affected",
"version": "1.12"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The patch is named c086cb139af7c82845f6d565e636073ff4b37440. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221499."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in UIKit0 libplist 1.12 entdeckt. Sie wurde als problematisch eingestuft. Betroffen hiervon ist die Funktion plist_from_xml der Datei src/xplist.c der Komponente XML Handler. Durch die Manipulation mit unbekannten Daten kann eine xml external entity reference-Schwachstelle ausgenutzt werden. Der Patch wird als c086cb139af7c82845f6d565e636073ff4b37440 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.2,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T08:58:52.317Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.221499"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.221499"
},
{
"tags": [
"patch"
],
"url": "https://github.com/UIKit0/libplist/commit/c086cb139af7c82845f6d565e636073ff4b37440"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-02-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-02-19T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-02-19T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-03-23T11:08:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "UIKit0 libplist XML xplist.c plist_from_xml xml external entity reference"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2015-10082",
"datePublished": "2023-02-21T07:00:05.828Z",
"dateReserved": "2023-02-19T15:52:05.564Z",
"dateUpdated": "2024-08-06T08:58:26.353Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7982 (GCVE-0-2017-7982)
Vulnerability from cvelistv5 – Published: 2017-04-20 14:00 – Updated: 2024-08-05 16:19
VLAI
Summary
Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/libimobiledevice/libplist/issues/103 | x_refsource_CONFIRM |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
Date Public
2017-04-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:19:29.515Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/issues/103"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-04-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-02T09:06:07.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/issues/103"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-7982",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/libimobiledevice/libplist/issues/103",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/issues/103"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-7982",
"datePublished": "2017-04-20T14:00:00.000Z",
"dateReserved": "2017-04-20T00:00:00.000Z",
"dateUpdated": "2024-08-05T16:19:29.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5835 (GCVE-0-2017-5835)
Vulnerability from cvelistv5 – Published: 2017-03-03 15:00 – Updated: 2024-08-05 15:11
VLAI
Summary
libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/96022 | vdb-entryx_refsource_BID |
| https://github.com/libimobiledevice/libplist/issues/88 | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2017/01/31/6 | mailing-listx_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2017/02/02/4 | mailing-listx_refsource_MLIST |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
Date Public
2017-01-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:11:48.899Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/issues/88"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-02T09:06:07.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/issues/88"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5835",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "96022",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96022"
},
{
"name": "https://github.com/libimobiledevice/libplist/issues/88",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/issues/88"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5835",
"datePublished": "2017-03-03T15:00:00.000Z",
"dateReserved": "2017-02-01T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:11:48.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5836 (GCVE-0-2017-5836)
Vulnerability from cvelistv5 – Published: 2017-03-03 15:00 – Updated: 2024-08-05 15:11
VLAI
Summary
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/libimobiledevice/libplist/issues/86 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/96022 | vdb-entryx_refsource_BID |
| http://www.openwall.com/lists/oss-security/2017/01/31/6 | mailing-listx_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2017/02/02/4 | mailing-listx_refsource_MLIST |
Date Public
2017-01-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:11:48.884Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/issues/86"
},
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-06T10:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/issues/86"
},
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5836",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/libimobiledevice/libplist/issues/86",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/issues/86"
},
{
"name": "96022",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96022"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5836",
"datePublished": "2017-03-03T15:00:00.000Z",
"dateReserved": "2017-02-01T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:11:48.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5834 (GCVE-0-2017-5834)
Vulnerability from cvelistv5 – Published: 2017-03-03 15:00 – Updated: 2024-08-05 15:11
VLAI
Summary
The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/96022 | vdb-entryx_refsource_BID |
| https://github.com/libimobiledevice/libplist/issues/89 | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2017/01/31/6 | mailing-listx_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2017/02/02/4 | mailing-listx_refsource_MLIST |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
Date Public
2017-01-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:11:48.909Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/issues/89"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-02T09:06:05.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/issues/89"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5834",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "96022",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96022"
},
{
"name": "https://github.com/libimobiledevice/libplist/issues/89",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/issues/89"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5834",
"datePublished": "2017-03-03T15:00:00.000Z",
"dateReserved": "2017-02-01T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:11:48.909Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5545 (GCVE-0-2017-5545)
Vulnerability from cvelistv5 – Published: 2017-01-21 01:00 – Updated: 2024-08-05 15:04
VLAI
Summary
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/libimobiledevice/libplist/comm… | x_refsource_CONFIRM |
| https://github.com/libimobiledevice/libplist/issues/87 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/95702 | vdb-entryx_refsource_BID |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
Date Public
2017-01-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:04:15.311Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/issues/87"
},
{
"name": "95702",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95702"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-02T09:06:05.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/issues/87"
},
{
"name": "95702",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95702"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5545",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee"
},
{
"name": "https://github.com/libimobiledevice/libplist/issues/87",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/issues/87"
},
{
"name": "95702",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95702"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5545",
"datePublished": "2017-01-21T01:00:00.000Z",
"dateReserved": "2017-01-20T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:04:15.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5209 (GCVE-0-2017-5209)
Vulnerability from cvelistv5 – Published: 2017-01-11 16:00 – Updated: 2024-08-05 14:55
VLAI
Summary
The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/95385 | vdb-entryx_refsource_BID |
| https://github.com/libimobiledevice/libplist/comm… | x_refsource_CONFIRM |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
Date Public
2017-01-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T14:55:35.757Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "95385",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95385"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-02T09:06:04.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "95385",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95385"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5209",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "95385",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95385"
},
{
"name": "https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5209",
"datePublished": "2017-01-11T16:00:00.000Z",
"dateReserved": "2017-01-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T14:55:35.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2015-10082 (GCVE-0-2015-10082)
Vulnerability from nvd – Published: 2023-02-21 07:00 – Updated: 2024-08-06 08:58
VLAI
Title
UIKit0 libplist XML xplist.c plist_from_xml xml external entity reference
Summary
A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The patch is named c086cb139af7c82845f6d565e636073ff4b37440. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221499.
Severity
5.5 (Medium)
5.5 (Medium)
CWE
- CWE-611 - XML External Entity Reference
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://vuldb.com/?id.221499 | vdb-entrytechnical-description |
| https://vuldb.com/?ctiid.221499 | signaturepermissions-required |
| https://github.com/UIKit0/libplist/commit/c086cb1… | patch |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T08:58:26.353Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description",
"x_transferred"
],
"url": "https://vuldb.com/?id.221499"
},
{
"tags": [
"signature",
"permissions-required",
"x_transferred"
],
"url": "https://vuldb.com/?ctiid.221499"
},
{
"tags": [
"patch",
"x_transferred"
],
"url": "https://github.com/UIKit0/libplist/commit/c086cb139af7c82845f6d565e636073ff4b37440"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"modules": [
"XML Handler"
],
"product": "libplist",
"vendor": "UIKit0",
"versions": [
{
"status": "affected",
"version": "1.12"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "tool",
"value": "VulDB GitHub Commit Analyzer"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The patch is named c086cb139af7c82845f6d565e636073ff4b37440. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221499."
},
{
"lang": "de",
"value": "Es wurde eine Schwachstelle in UIKit0 libplist 1.12 entdeckt. Sie wurde als problematisch eingestuft. Betroffen hiervon ist die Funktion plist_from_xml der Datei src/xplist.c der Komponente XML Handler. Durch die Manipulation mit unbekannten Daten kann eine xml external entity reference-Schwachstelle ausgenutzt werden. Der Patch wird als c086cb139af7c82845f6d565e636073ff4b37440 bezeichnet. Als bestm\u00f6gliche Massnahme wird Patching empfohlen."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.2,
"vectorString": "AV:A/AC:L/Au:S/C:P/I:P/A:P",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-611",
"description": "CWE-611 XML External Entity Reference",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-10-20T08:58:52.317Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/?id.221499"
},
{
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/?ctiid.221499"
},
{
"tags": [
"patch"
],
"url": "https://github.com/UIKit0/libplist/commit/c086cb139af7c82845f6d565e636073ff4b37440"
}
],
"timeline": [
{
"lang": "en",
"time": "2023-02-19T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2023-02-19T00:00:00.000Z",
"value": "CVE reserved"
},
{
"lang": "en",
"time": "2023-02-19T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2023-03-23T11:08:47.000Z",
"value": "VulDB entry last update"
}
],
"title": "UIKit0 libplist XML xplist.c plist_from_xml xml external entity reference"
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2015-10082",
"datePublished": "2023-02-21T07:00:05.828Z",
"dateReserved": "2023-02-19T15:52:05.564Z",
"dateUpdated": "2024-08-06T08:58:26.353Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-7982 (GCVE-0-2017-7982)
Vulnerability from nvd – Published: 2017-04-20 14:00 – Updated: 2024-08-05 16:19
VLAI
Summary
Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/libimobiledevice/libplist/issues/103 | x_refsource_CONFIRM |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
Date Public
2017-04-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T16:19:29.515Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/issues/103"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-04-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-02T09:06:07.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/issues/103"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-7982",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/libimobiledevice/libplist/issues/103",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/issues/103"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-7982",
"datePublished": "2017-04-20T14:00:00.000Z",
"dateReserved": "2017-04-20T00:00:00.000Z",
"dateUpdated": "2024-08-05T16:19:29.515Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5836 (GCVE-0-2017-5836)
Vulnerability from nvd – Published: 2017-03-03 15:00 – Updated: 2024-08-05 15:11
VLAI
Summary
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/libimobiledevice/libplist/issues/86 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/96022 | vdb-entryx_refsource_BID |
| http://www.openwall.com/lists/oss-security/2017/01/31/6 | mailing-listx_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2017/02/02/4 | mailing-listx_refsource_MLIST |
Date Public
2017-01-15 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:11:48.884Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/issues/86"
},
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-06T10:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/issues/86"
},
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5836",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/libimobiledevice/libplist/issues/86",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/issues/86"
},
{
"name": "96022",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96022"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5836",
"datePublished": "2017-03-03T15:00:00.000Z",
"dateReserved": "2017-02-01T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:11:48.884Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5835 (GCVE-0-2017-5835)
Vulnerability from nvd – Published: 2017-03-03 15:00 – Updated: 2024-08-05 15:11
VLAI
Summary
libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/96022 | vdb-entryx_refsource_BID |
| https://github.com/libimobiledevice/libplist/issues/88 | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2017/01/31/6 | mailing-listx_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2017/02/02/4 | mailing-listx_refsource_MLIST |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
Date Public
2017-01-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:11:48.899Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/issues/88"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-02T09:06:07.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/issues/88"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5835",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "96022",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96022"
},
{
"name": "https://github.com/libimobiledevice/libplist/issues/88",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/issues/88"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5835",
"datePublished": "2017-03-03T15:00:00.000Z",
"dateReserved": "2017-02-01T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:11:48.899Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5834 (GCVE-0-2017-5834)
Vulnerability from nvd – Published: 2017-03-03 15:00 – Updated: 2024-08-05 15:11
VLAI
Summary
The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
5 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/96022 | vdb-entryx_refsource_BID |
| https://github.com/libimobiledevice/libplist/issues/89 | x_refsource_CONFIRM |
| http://www.openwall.com/lists/oss-security/2017/01/31/6 | mailing-listx_refsource_MLIST |
| http://www.openwall.com/lists/oss-security/2017/02/02/4 | mailing-listx_refsource_MLIST |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
Date Public
2017-01-17 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:11:48.909Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/issues/89"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-17T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-02T09:06:05.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "96022",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96022"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/issues/89"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5834",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "96022",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96022"
},
{
"name": "https://github.com/libimobiledevice/libplist/issues/89",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/issues/89"
},
{
"name": "[oss-security] 20170131 CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/01/31/6"
},
{
"name": "[oss-security] 20170202 Re: CVE request: multiples vulnerabilities in libplist",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2017/02/02/4"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5834",
"datePublished": "2017-03-03T15:00:00.000Z",
"dateReserved": "2017-02-01T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:11:48.909Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5545 (GCVE-0-2017-5545)
Vulnerability from nvd – Published: 2017-01-21 01:00 – Updated: 2024-08-05 15:04
VLAI
Summary
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/libimobiledevice/libplist/comm… | x_refsource_CONFIRM |
| https://github.com/libimobiledevice/libplist/issues/87 | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/95702 | vdb-entryx_refsource_BID |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
Date Public
2017-01-20 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:04:15.311Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/issues/87"
},
{
"name": "95702",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95702"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-20T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-02T09:06:05.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/issues/87"
},
{
"name": "95702",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95702"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5545",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee"
},
{
"name": "https://github.com/libimobiledevice/libplist/issues/87",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/issues/87"
},
{
"name": "95702",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95702"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5545",
"datePublished": "2017-01-21T01:00:00.000Z",
"dateReserved": "2017-01-20T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:04:15.311Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-5209 (GCVE-0-2017-5209)
Vulnerability from nvd – Published: 2017-01-11 16:00 – Updated: 2024-08-05 14:55
VLAI
Summary
The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.securityfocus.com/bid/95385 | vdb-entryx_refsource_BID |
| https://github.com/libimobiledevice/libplist/comm… | x_refsource_CONFIRM |
| https://lists.debian.org/debian-lts-announce/2020… | mailing-listx_refsource_MLIST |
Date Public
2017-01-11 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T14:55:35.757Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "95385",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/95385"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-01-11T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2020-04-02T09:06:04.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "95385",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/95385"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-5209",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "95385",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/95385"
},
{
"name": "https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957",
"refsource": "CONFIRM",
"url": "https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957"
},
{
"name": "[debian-lts-announce] 20200402 [SECURITY] [DLA 2168-1] libplist security update",
"refsource": "MLIST",
"url": "https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-5209",
"datePublished": "2017-01-11T16:00:00.000Z",
"dateReserved": "2017-01-09T00:00:00.000Z",
"dateUpdated": "2024-08-05T14:55:35.757Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}