ASA-201705-18 log original external raw
[ASA-201705-18] libplist: multiple issues |
---|
Arch Linux Security Advisory ASA-201705-18
==========================================
Severity: High
Date : 2017-05-16
CVE-ID : CVE-2017-5209 CVE-2017-5545 CVE-2017-5834 CVE-2017-5835
CVE-2017-5836 CVE-2017-6435 CVE-2017-6436 CVE-2017-6437
CVE-2017-6438 CVE-2017-6439 CVE-2017-6440
Package : libplist
Type : multiple issues
Remote : Yes
Link : https://security.archlinux.org/AVG-215
Summary
=======
The package libplist before version 2.0.0-1 is vulnerable to multiple
issues including arbitrary command execution, denial of service and
information disclosure.
Resolution
==========
Upgrade to 2.0.0-1.
# pacman -Syu "libplist>=2.0.0-1"
The problems have been fixed upstream in version 2.0.0.
Workaround
==========
None.
Description
===========
- CVE-2017-5209 (information disclosure)
The base64decode function in base64.c in libimobiledevice libplist
through 1.12 allows attackers to obtain sensitive information from
process memory or cause a denial of service (buffer over-read) via
split encoded Apple Property List data.
- CVE-2017-5545 (denial of service)
The main function in plistutil.c in libimobiledevice libplist through
1.12 allows attackers to obtain sensitive information from process
memory or cause a denial of service (buffer over-read) via Apple
Property List data that is too short.
- CVE-2017-5834 (denial of service)
The parse_dict_node function in bplist.c in libplist allows attackers
to cause a denial of service (out-of-bounds heap read and crash) via a
crafted file.
- CVE-2017-5835 (denial of service)
libplist allows attackers to cause a denial of service (large memory
allocation and crash) via vectors involving an offset size of zero.
- CVE-2017-5836 (denial of service)
The plist_free_data function in plist.c in libplist allows attackers to
cause a denial of service (crash) via vectors involving an integer node
that is treated as a PLIST_KEY and then triggers an invalid free.
- CVE-2017-6435 (denial of service)
The parse_string_node function in bplist.c in libimobiledevice libplist
1.12 allows local users to cause a denial of service (memory
corruption) via a crafted plist file.
- CVE-2017-6436 (denial of service)
The parse_string_node function in bplist.c in libimobiledevice libplist
1.12 allows local users to cause a denial of service (memory allocation
error) via a crafted plist file.
- CVE-2017-6437 (denial of service)
The base64encode function in base64.c in libimobiledevice libplist 1.12
allows local users to cause a denial of service (out-of-bounds read)
via a crafted plist file.
- CVE-2017-6438 (arbitrary command execution)
Heap-based buffer overflow in the parse_unicode_node function in
bplist.c in libimobiledevice libplist 1.12 allows local users to cause
a denial of service (out-of-bounds write) and possibly code execution
via a crafted plist file.
- CVE-2017-6439 (denial of service)
Heap-based buffer overflow in the parse_string_node function in
bplist.c in libimobiledevice libplist 1.12 allows local users to cause
a denial of service (out-of-bounds write) via a crafted plist file.
- CVE-2017-6440 (denial of service)
The parse_data_node function in bplist.c in libimobiledevice libplist
1.12 allows local users to cause a denial of service (memory allocation
error) via a crafted plist file.
Impact
======
An attacker is able to crash the process, read sensitive information or
execute arbitrary code on the host by providing a crafted plist file or
string.
References
==========
https://github.com/libimobiledevice/libplist/issues/93
https://github.com/libimobiledevice/libplist/issues/94
https://github.com/libimobiledevice/libplist/issues/95
https://github.com/libimobiledevice/libplist/issues/99
https://github.com/libimobiledevice/libplist/issues/98
https://github.com/libimobiledevice/libplist/issues/100
https://github.com/libimobiledevice/libplist/blob/master/NEWS
https://bugzilla.redhat.com/show_bug.cgi?id=1412613
https://bugzilla.redhat.com/show_bug.cgi?id=1416002
https://bugzilla.redhat.com/show_bug.cgi?id=1418591
https://bugzilla.redhat.com/show_bug.cgi?id=1418592
https://bugzilla.redhat.com/show_bug.cgi?id=1418593
https://security.archlinux.org/CVE-2017-5209
https://security.archlinux.org/CVE-2017-5545
https://security.archlinux.org/CVE-2017-5834
https://security.archlinux.org/CVE-2017-5835
https://security.archlinux.org/CVE-2017-5836
https://security.archlinux.org/CVE-2017-6435
https://security.archlinux.org/CVE-2017-6436
https://security.archlinux.org/CVE-2017-6437
https://security.archlinux.org/CVE-2017-6438
https://security.archlinux.org/CVE-2017-6439
https://security.archlinux.org/CVE-2017-6440
|