Bugzilla – Bug 1019531
VUL-1: CVE-2017-5209: libplist: base64decode buffer over-read via split encoded Apple Property List data
Last modified: 2017-05-28 01:08:45 UTC
The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data. https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957 References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5209 http://www.cvedetails.com/cve/CVE-2017-5209/
Upstream bug has an example: https://github.com/libimobiledevice/libplist/issues/84
bugbot adjusting priority
Adding maintainers to cc
reassigned to myself. it's my package.
maintenance request for released products: https://build.opensuse.org/request/show/452439
(In reply to Marguerite Su from comment #4) > reassigned to myself. it's my package. Just a heads up that for LEAP, this is a SLE package, so getting a fixed version out requires sync with SLE maintainers too. That was the reason I added you to cc Adding bnc-gnome to cc
This is an autogenerated message for OBS integration: This bug (1019531) was mentioned in https://build.opensuse.org/request/show/453577 42.1 / libplist
This is an autogenerated message for OBS integration: This bug (1019531) was mentioned in https://build.opensuse.org/request/show/453668 42.1 / libplist https://build.opensuse.org/request/show/453671 42.2 / libplist
This is an autogenerated message for OBS integration: This bug (1019531) was mentioned in https://build.opensuse.org/request/show/453870 42.3 / libplist
openSUSE-SU-2017:0428-1: An update that fixes two vulnerabilities is now available. Category: security (low) Bug References: 1019531,1021610 CVE References: CVE-2017-5209,CVE-2017-5545 Sources used: openSUSE Leap 42.2 (src): libplist-1.12-5.1 openSUSE Leap 42.1 (src): libplist-1.12-4.1
openSUSE-SU-2017:0528-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1019531,1023807,1023822,1023848 CVE References: CVE-2017-5209,CVE-2017-5834,CVE-2017-5835,CVE-2017-5836 Sources used: openSUSE Leap 42.1 (src): libplist-1.12-7.1
fixed
SUSE-SU-2017:1368-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1019531,1021610,1023807,1023822,1023848,1029631,1035312 CVE References: CVE-2017-5209,CVE-2017-5545,CVE-2017-5834,CVE-2017-5835,CVE-2017-5836,CVE-2017-6440,CVE-2017-7982 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP1 (src): libplist-1.8-10.9.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): libplist-1.8-10.9.1 SUSE Linux Enterprise Software Development Kit 12-SP1 (src): libplist-1.8-10.9.1 SUSE Linux Enterprise Server 12-SP1 (src): libplist-1.8-10.9.1 SUSE Linux Enterprise Desktop 12-SP1 (src): libplist-1.8-10.9.1
SUSE-SU-2017:1379-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1019531,1021610,1023807,1023822,1023848,1029631,1035312 CVE References: CVE-2017-5209,CVE-2017-5545,CVE-2017-5834,CVE-2017-5835,CVE-2017-5836,CVE-2017-6440,CVE-2017-7982 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP2 (src): libplist-1.12-19.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): libplist-1.12-19.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): libplist-1.12-19.1 SUSE Linux Enterprise Server 12-SP2 (src): libplist-1.12-19.1 SUSE Linux Enterprise Desktop 12-SP2 (src): libplist-1.12-19.1
openSUSE-SU-2017:1426-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1019531,1021610,1023807,1023822,1023848,1029631,1035312 CVE References: CVE-2017-5209,CVE-2017-5545,CVE-2017-5834,CVE-2017-5835,CVE-2017-5836,CVE-2017-6440,CVE-2017-7982 Sources used: openSUSE Leap 42.2 (src): libplist-1.12-7.3.1