CVE-2017-5545
CriticalSummary
The main function in plistutil.c in libimobiledevice libplist through version 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
Risk Assessment
Organizations may be exposed to sensitive information leakage or service disruptions, which can lead to serious data security consequences.
Recommendation
It is recommended to update libimobiledevice libplist to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in libimobiledevice libplist
See all- CVE-2017-6438High
Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.
- CVE-2017-5209Critical
The base64decode function in base64.c in libimobiledevice libplist through version 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.
Original NVD description (English source)
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.