CVE-2015-10082

UIKit0 libplist XML xplist.c plist_from_xml xml external entity reference

5.5 MediumFix available

A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The patch is named c086cb139af7c82845f6d565e636073ff4b37440. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221499.

Attack profile

How easy it is to exploit

Attack vector: Adjacent network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.72%Down 0.2 points since Feb 21, 2023

What each source reports

CVE List Score used 5.5

UIKit0 libplist XML xplist.c plist_from_xml xml external entity reference

Record: CVE-2015-10082
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.0: 5.5 MediumCVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 2.0: 5.2 AV:A/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-611
Updated: 2026-11-02

EUVDEUVD-2015-1093 5.5

Record: EUVD-2015-1093
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-5x77-r5qj-224h 9.8

A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects...

A vulnerability classified as problematic has been found in UIKit0 libplist 1.12. This affects the function plist_from_xml of the file src/xplist.c of the component XML Handler. The manipulation leads to xml external entity reference. The name of the patch is c086cb139af7c82845f6d565e636073ff4b37440. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-221499.

Record: GHSA-5x77-r5qj-224h
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-611
Updated: 2026-11-02

NVD 5.5

Record: CVE-2015-10082
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 5.2 MediumAV:A/AC:L/Au:S/C:P/I:P/A:P
Weakness: CWE-611
Updated: 2026-11-02

OSVSUSE-SU-2023:0872-1 No score

Security update for libplist

This update for libplist fixes the following issues:

CVE-2015-10082: Fixed XXEsecurity vulnerability with XML plists (bsc#1208546).

Record: SUSE-SU-2023:0872-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`libplist` SUSE:Linux Enterprise Software Development Kit 12 SP5	before 1.12-20.6.1	1.12-20.6.1
`libplist` SUSE:Linux Enterprise Server 12 SP5	before 1.12-20.6.1	1.12-20.6.1
`libplist` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	before 1.12-20.6.1	1.12-20.6.1
`libplist` SUSE:Linux Enterprise Workstation Extension 12 SP5	before 1.12-20.6.1	1.12-20.6.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-10082 is a medium vulnerability (CVSS 5.5) in Libimobiledevice Libplist, published February 21, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.72%, the 54th percentile. Fixed in libplist 1.12-20.6.1.