CVE-2016-5104
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote...
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
- Record
CVE-2016-5104- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
- Record
CVE-2016-5104- Updated
- 2026-11-02
EUVDEUVD-2016-6055 No score
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
- Record
EUVD-2016-6055- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v8rh-c9vm-p8g7
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote...
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
- Record
GHSA-v8rh-c9vm-p8g7- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
- Record
CVE-2016-5104- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2016-5104
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
- Record
DEBIAN-CVE-2016-5104- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2016-5104
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket.
- Record
UBUNTU-CVE-2016-5104- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVMGASA-2016-0229 No score
Updated libimobiledevice packages fix CVE-2016-5104
Updated libimobiledevice and usbmuxd package fixes security vulnerability:
The libimobiledevice and libusbmuxd libraries open a socket that listens on all available network interfaces, rather than just the loopback interface as was intended (CVE-2016-5104).
- Record
MGASA-2016-0229- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10373-1 No score
iproxy-1.0.10-3.4 on GA media
These are all security issues fixed in the iproxy-1.0.10-3.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10373-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10459-1 No score
imobiledevice-tools-1.2.0-3.4 on GA media
These are all security issues fixed in the imobiledevice-tools-1.2.0-3.4 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10459-1- Updated
- 2026-11-02
OSVSUSE-SU-2016:1639-1 No score
Security update for libimobiledevice, usbmuxd
libimobiledevice, usbmuxd were updated to fix one security issue.
This security issue was fixed:
- CVE-2016-5104: Sockets listening on INADDR_ANY instead of only locally (982014).
- Record
SUSE-SU-2016:1639-1- Updated
- 2026-11-02
OSVUSN-3026-1 No score
libimobiledevice vulnerability
It was discovered that libimobiledevice incorrectly handled socket permissions. A remote attacker could use this issue to access services on iOS devices, contrary to expectations.
- Record
USN-3026-1- Updated
- 2026-11-02
OSVUSN-3026-2 No score
libusbmuxd vulnerability
It was discovered that libusbmuxd incorrectly handled socket permissions. A remote attacker could use this issue to access services on iOS devices, contrary to expectations.
- Record
USN-3026-2- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libimobiledeviceDebian:12 |
before 1.2.0+dfsg-3 | 1.2.0+dfsg-3 |
libimobiledeviceDebian:13 |
before 1.2.0+dfsg-3 | 1.2.0+dfsg-3 |
libimobiledeviceDebian:14 |
before 1.2.0+dfsg-3 | 1.2.0+dfsg-3 |
libusbmuxdDebian:12 |
before 1.0.10-3 | 1.0.10-3 |
libusbmuxdDebian:13 |
before 1.0.10-3 | 1.0.10-3 |
libusbmuxdDebian:14 |
before 1.0.10-3 | 1.0.10-3 |
libimobiledeviceDebian:8 |
before 1.1.6+dfsg-3.1+deb8u1, plus listed versions 1.1.6+dfsg-3.1 |
1.1.6+dfsg-3.1+deb8u1 |
libusbmuxdDebian:8 |
before 1.0.9-1+deb8u1, plus listed versions 1.0.9-1 |
1.0.9-1+deb8u1 |
libimobiledeviceMageia:5 |
before 1.1.6-4.1.mga5 | 1.1.6-4.1.mga5 |
usbmuxdMageia:5 |
before 1.0.9-6.1.mga5 | 1.0.9-6.1.mga5 |
Show 21 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libimobiledeviceSUSE:Linux Enterprise Desktop 12 |
before 1.1.5-6.1 | 1.1.5-6.1 |
usbmuxdSUSE:Linux Enterprise Desktop 12 |
before 1.0.8-12.1 | 1.0.8-12.1 |
libimobiledeviceSUSE:Linux Enterprise Desktop 12 SP1 |
before 1.1.5-6.1 | 1.1.5-6.1 |
usbmuxdSUSE:Linux Enterprise Desktop 12 SP1 |
before 1.0.8-12.1 | 1.0.8-12.1 |
libimobiledeviceSUSE:Linux Enterprise Software Development Kit 12 |
before 1.1.5-6.1 | 1.1.5-6.1 |
usbmuxdSUSE:Linux Enterprise Software Development Kit 12 |
before 1.0.8-12.1 | 1.0.8-12.1 |
libimobiledeviceSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 1.1.5-6.1 | 1.1.5-6.1 |
usbmuxdSUSE:Linux Enterprise Software Development Kit 12 SP1 |
before 1.0.8-12.1 | 1.0.8-12.1 |
libimobiledeviceSUSE:Linux Enterprise Server 12 |
before 1.1.5-6.1 | 1.1.5-6.1 |
usbmuxdSUSE:Linux Enterprise Server 12 |
before 1.0.8-12.1 | 1.0.8-12.1 |
libimobiledeviceSUSE:Linux Enterprise Server for SAP Applications 12 |
before 1.1.5-6.1 | 1.1.5-6.1 |
usbmuxdSUSE:Linux Enterprise Server for SAP Applications 12 |
before 1.0.8-12.1 | 1.0.8-12.1 |
libimobiledeviceSUSE:Linux Enterprise Server 12 SP1 |
before 1.1.5-6.1 | 1.1.5-6.1 |
usbmuxdSUSE:Linux Enterprise Server 12 SP1 |
before 1.0.8-12.1 | 1.0.8-12.1 |
libimobiledeviceSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.1.5-6.1 | 1.1.5-6.1 |
usbmuxdSUSE:Linux Enterprise Server for SAP Applications 12 SP1 |
before 1.0.8-12.1 | 1.0.8-12.1 |
libimobiledeviceSUSE:Linux Enterprise Workstation Extension 12 |
before 1.1.5-6.1 | 1.1.5-6.1 |
libimobiledeviceSUSE:Linux Enterprise Workstation Extension 12 SP1 |
before 1.1.5-6.1 | 1.1.5-6.1 |
libimobiledeviceUbuntu:14.04:LTS |
before 1.1.5+git20140313.bafe6a9e-0ubuntu1.1, plus listed versions 1.1.5-0ubuntu21.1.5-21.1.5-2build11.1.5+git20140313.bafe6a9e-0ubuntu1 |
1.1.5+git20140313.bafe6a9e-0ubuntu1.1 |
libimobiledeviceUbuntu:16.04:LTS |
before 1.2.0+dfsg-3~ubuntu0.2, plus listed versions 1.1.6+dfsg-3.1build11.2.0+dfsg-11.2.0+dfsg-21.2.0+dfsg-2.11.2.0+dfsg-2.1build11.2.0+dfsg-3~ubuntu0.1 |
1.2.0+dfsg-3~ubuntu0.2 |
libusbmuxdUbuntu:16.04:LTS |
before 1.0.10-2ubuntu0.1, plus listed versions 1.0.9-1build11.0.10-2 |
1.0.10-2ubuntu0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2016-5104 is a medium vulnerability (CVSS 5.3) in Libimobiledevice, published June 13, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.99%, the 87th percentile. Fixed in libimobiledevice 1.2.0+dfsg-3.
References
lists.opensuse.org/opensuse-updates/2016-06/msg00029.html
bugzilla.redhat.com/show_bug.cgi?id=1339988
ubuntu.com/usn/USN-3026-1
github.com/libimobiledevice/libusbmuxd/commit/4397b3376dc4e4cb1c991d0aed61ce6482614196
openwall.com/lists/oss-security/2016/05/26/1
Show 18 moreShow less
lists.debian.org/debian-lts-announce/2020/02/msg00027.html
nvd.nist.gov/vuln/detail/CVE-2016-5104
security-tracker.debian.org/tracker/CVE-2016-5104
advisories.mageia.org/MGASA-2016-0229.html
bugs.mageia.org/show_bug.cgi?id=18559
suse.com/support/update/announcement/2016/suse-su-20161639-1
bugzilla.suse.com/982014
ubuntu.com/security/CVE-2016-5104
cve.org/CVERecord?id=CVE-2016-5104