CVE-2017-5545

Published: 21 January 2017

The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.

Priority

Negligible

CVSS 3 base score: 9.1

Status

Package Release Status
libplist
Launchpad, Ubuntu, Debian
Upstream
Released (1.12+git+1+e37ca00-0.1)
Ubuntu 21.04 (Hirsute Hippo) Not vulnerable
(1.12+git+1+e37ca00-0.3)
Ubuntu 20.04 LTS (Focal Fossa) Not vulnerable
(1.12+git+1+e37ca00-0.3)
Ubuntu 18.04 LTS (Bionic Beaver) Not vulnerable
(1.12+git+1+e37ca00-0.3)
Ubuntu 16.04 ESM (Xenial Xerus) Needed

Ubuntu 14.04 ESM (Trusty Tahr) Does not exist
(trusty was needed)
Patches:
Upstream: https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee
Binaries built from this source package are in Universe and so are supported by the community.

Notes

AuthorNote
tyhicks
Affected utility is found in the libplist source package rather than
in the libimobiledevice source package
sbeattie
also, the affected code is just in the plistutil binary, not
in the library itself

References

Bugs