Vulnerability CVE-2017-6438

Vulnerability CVE-2017-6438

Published: 2017-03-15

Description:

Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.

CVSS2 => (AV:L/AC:M/Au:N/C:P/I:P/A:P)

CVSS Base Score	Impact Subscore	Exploitability Subscore
4.4/10	6.4/10	3.4/10

Exploit range	Attack complexity	Authentication
Local	Medium	No required
Confidentiality impact	Integrity impact	Availability impact
Partial	Partial	Partial

Affected software
Libplist project -> Libplist

References:

http://www.securityfocus.com/bid/97281

https://github.com/libimobiledevice/libplist/issues/98

Copyright 2024, cxsecurity.com