CVE-2017-5209
CriticalSummary
The base64decode function in base64.c in libimobiledevice libplist through version 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.
Risk Assessment
Organizations may be exposed to sensitive data leaks or system crashes, potentially leading to service downtime.
Recommendation
It is recommended to update libimobiledevice libplist to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in libimobiledevice libplist
See all- CVE-2017-6438High
Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.
- CVE-2017-5545Critical
The main function in plistutil.c in libimobiledevice libplist through version 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
Original NVD description (English source)
The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.