SUSE-SU-2017:1368-1

Dashboard / Vulnerabilities / SUSE-SU-2017:1368-1

SUSE-SU-2017:1368-1

Summary: Security update for libplist

Details: This update for libplist fixes the following security issues: - CVE-2017-5545: The main function in plistutil.c in libimobiledevice libplist allowed attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short. (bsc#1021610). - CVE-2017-5209: The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data. (bsc#1019531) - CVE-2017-5836: A type inconsistency in bplist.c was fixed. (bsc#1023807) - CVE-2017-5835: A memory allocation error leading to DoS was fixed. (bsc#1023822) - CVE-2017-5834: A heap-buffer overflow in parse_dict_node was fixed (bsc#1023848) - CVE-2017-7982: Denial of service (heap-based buffer over-read and application crash) via a crafted plist file (bsc#1035312) - CVE-2017-6440: A specially crafted plist file could lead to denial of service (bsc#1029631)

References: https://www.suse.com/support/update/announcement/2017/suse-su-20171368-1/, https://bugzilla.suse.com/1019531, https://bugzilla.suse.com/1021610, https://bugzilla.suse.com/1023807, https://bugzilla.suse.com/1023822, https://bugzilla.suse.com/1023848, https://bugzilla.suse.com/1029631, https://bugzilla.suse.com/1035312, https://www.suse.com/security/cve/CVE-2017-5209, https://www.suse.com/security/cve/CVE-2017-5545, https://www.suse.com/security/cve/CVE-2017-5834, https://www.suse.com/security/cve/CVE-2017-5835, https://www.suse.com/security/cve/CVE-2017-5836, https://www.suse.com/security/cve/CVE-2017-6440, https://www.suse.com/security/cve/CVE-2017-7982