CVE-2017-7982

Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file.

The base64decode function in libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data (CVE-2017-5209).

The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short (CVE-2017-5545).

A heap-buffer overflow in parse_dict_node could cause a segmentation fault (CVE-2017-5834).

Malicious crafted file could cause libplist to allocate large amounts of memory and consume lots of CPU because of a memory allocation error (CVE-2017-5835).

A type inconsistency in bplist.c could cause the application to crash (CVE-2017-5836).

Crafted plist file could lead to Heap-buffer overflow (CVE-2017-6435).

Integer overflow in parse_string_node (CVE-2017-6436).

The base64encode function in base64.c allows local users to cause denial of service (out-of-bounds read) via a crafted plist file (CVE-2017-6437).

Heap-based buffer overflow in the parse_unicode_node function (CVE-2017-6438).

Heap-based buffer overflow in the parse_string_node function (CVE-2017-6439).

Ensure that sanity checks work on 32-bit platforms (CVE-2017-6440).

Add some safety checks, backported from upstream (CVE-2017-7982).

The gvfs, ifuse, kodi, libgpod, libimobiledevice, upower, and usbmuxd packages have been rebuilt for the updated libplist.

This update for libplist fixes the following security issues:

• CVE-2017-5545: The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. (bsc#1021610).
• CVE-2017-5209: The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data. (bsc#1019531)
• CVE-2017-5836: A type inconsistency in bplist.c was fixed. (bsc#1023807)
• CVE-2017-5835: A memory allocation error leading to DoS was fixed. (bsc#1023822)
• CVE-2017-5834: A heap-buffer overflow in parse_dict_node was fixed (bsc#1023848)
• CVE-2017-7982: Denial of service (heap-based buffer over-read and application crash) via a crafted plist file (bsc#1035312)
• CVE-2017-6440: A specially crafted plist file could lead to denial of service (bsc#1029631)

This update for libplist fixes the following issues:

• CVE-2017-5209: The base64decode function in libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data (bsc#1019531).
• CVE-2017-5545: The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. (bsc#1021610).
• CVE-2017-5836: A type inconsistency in bplist.c was fixed. (bsc#1023807)
• CVE-2017-5835: A memory allocation error leading to DoS was fixed. (bsc#1023822)
• CVE-2017-5834: A heap-buffer overflow in parse_dict_node was fixed. (bsc#1023848)
• CVE-2017-6440: Ensure that sanity checks work on 32-bit platforms. (bsc#1029631)
• CVE-2017-7982: Add some safety checks, backported from upstream (bsc#1035312).
• CVE-2017-5836: A maliciously crafted file could cause the application to crash. (bsc#1023807).
• CVE-2017-5835: Malicious crafted file could cause libplist to allocate large amounts of memory and consume lots of CPU (bsc#1023822)
• CVE-2017-5834: Maliciou crafted file could cause a heap buffer overflow or segmentation fault (bsc#1023848)

Wang Junjie discovered that Libplist incorrectly handled certain files. If a user were tricked into opening a crafted file, an attacker could possibly use this to cause a crash or denial or service.