CVE-2017-5835

libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.

libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.

libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.

The base64decode function in libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data (CVE-2017-5209).

The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short (CVE-2017-5545).

A heap-buffer overflow in parse_dict_node could cause a segmentation fault (CVE-2017-5834).

Malicious crafted file could cause libplist to allocate large amounts of memory and consume lots of CPU because of a memory allocation error (CVE-2017-5835).

A type inconsistency in bplist.c could cause the application to crash (CVE-2017-5836).

Crafted plist file could lead to Heap-buffer overflow (CVE-2017-6435).

Integer overflow in parse_string_node (CVE-2017-6436).

The base64encode function in base64.c allows local users to cause denial of service (out-of-bounds read) via a crafted plist file (CVE-2017-6437).

Heap-based buffer overflow in the parse_unicode_node function (CVE-2017-6438).

Heap-based buffer overflow in the parse_string_node function (CVE-2017-6439).

Ensure that sanity checks work on 32-bit platforms (CVE-2017-6440).

Add some safety checks, backported from upstream (CVE-2017-7982).

The gvfs, ifuse, kodi, libgpod, libimobiledevice, upower, and usbmuxd packages have been rebuilt for the updated libplist.

This update for libplist fixes the following security issues:

• CVE-2017-5545: The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. (bsc#1021610).
• CVE-2017-5209: The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data. (bsc#1019531)
• CVE-2017-5836: A type inconsistency in bplist.c was fixed. (bsc#1023807)
• CVE-2017-5835: A memory allocation error leading to DoS was fixed. (bsc#1023822)
• CVE-2017-5834: A heap-buffer overflow in parse_dict_node was fixed (bsc#1023848)
• CVE-2017-7982: Denial of service (heap-based buffer over-read and application crash) via a crafted plist file (bsc#1035312)
• CVE-2017-6440: A specially crafted plist file could lead to denial of service (bsc#1029631)

This update for libplist fixes the following issues:

• CVE-2017-5209: The base64decode function in libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data (bsc#1019531).
• CVE-2017-5545: The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. (bsc#1021610).
• CVE-2017-5836: A type inconsistency in bplist.c was fixed. (bsc#1023807)
• CVE-2017-5835: A memory allocation error leading to DoS was fixed. (bsc#1023822)
• CVE-2017-5834: A heap-buffer overflow in parse_dict_node was fixed. (bsc#1023848)
• CVE-2017-6440: Ensure that sanity checks work on 32-bit platforms. (bsc#1029631)
• CVE-2017-7982: Add some safety checks, backported from upstream (bsc#1035312).
• CVE-2017-5836: A maliciously crafted file could cause the application to crash. (bsc#1023807).
• CVE-2017-5835: Malicious crafted file could cause libplist to allocate large amounts of memory and consume lots of CPU (bsc#1023822)
• CVE-2017-5834: Maliciou crafted file could cause a heap buffer overflow or segmentation fault (bsc#1023848)