libplist - Out of Bounds Read and Heap Buffer Overflow Vulnerabilities
Summary
DLA-811-1: libplist - security update. Affects libplist versions < 1.8-1+deb7u1. Fixed in 1.8-1+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libplist is a library for handling Apple Binary and XML Property Lists (plist). It provides functions to parse, manipulate, and generate plist files. The library is commonly used in various software applications that interact with Apple devices or utilize plist files. However, libplist versions prior to 1.8-1+deb7u1 are vulnerable to two security issues.
Vulnerability Detail
The first vulnerability, identified as CVE-2017-5209, involves an out-of-bounds read when parsing specially crafted Apple plist files. This flaw can be exploited by an attacker to read uninitialized or arbitrary memory, potentially leading to information disclosure or a crash.
The second vulnerability, known as CVE-2017-5545, is a heap buffer overflow that occurs when processing a maliciously crafted Apple plist file. An attacker could exploit this vulnerability to overwrite adjacent memory regions, potentially leading to remote code execution or a denial of service condition.
How To Fix
Minimum fixed version
1.8-1+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libplistTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workarounds have been provided for these vulnerabilities. It is essential to apply the recommended fix by upgrading the libplist package to the patched version.
Conclusion
libplist versions prior to 1.8-1+deb7u1 are affected by two vulnerabilities, CVE-2017-5209 and CVE-2017-5545. These vulnerabilities can lead to information disclosure, crashes, remote code execution, or denial of service conditions. It is crucial to upgrade the libplist package to version 1.8-1+deb7u1 or later to mitigate these risks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libplist →
FAQ
libplist is a library for handling Apple Binary and XML Property Lists (plist). It provides functions to parse, manipulate, and generate plist files.
CVE-2017-5209 can allow an attacker to read uninitialized or arbitrary memory, potentially leading to information disclosure or a crash.
CVE-2017-5545 can enable an attacker to overwrite adjacent memory regions, potentially leading to remote code execution or a denial of service condition.
To fix the vulnerabilities, upgrade the libplist package to version 1.8-1+deb7u1 or later.
No specific workarounds have been provided. It is recommended to apply the fix by upgrading the libplist package.
Related vulnerabilities
Recent vulnerabilities recorded for libplist.
