CVE-2017-6438
HighSummary
Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.
Risk Assessment
The organization may be exposed to denial of service and the possibility of unauthorized code execution, which can lead to serious security implications.
Recommendation
It is recommended to update the libimobiledevice library to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in libimobiledevice libplist 1.12
See all- CVE-2017-5545Critical
The main function in plistutil.c in libimobiledevice libplist through version 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.
- CVE-2017-5209Critical
The base64decode function in base64.c in libimobiledevice libplist through version 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.
Original NVD description (English source)
Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.