Bugzilla – Bug 1023807
VUL-1: CVE-2017-5836: libplist: Type inconsistency in bplist.c
Last modified: 2017-05-28 01:09:04 UTC
A vulnerability was found in libplist. A maliciously crafted file could cause the application to crash. Upstream bug and fix: https://github.com/libimobiledevice/libplist/issues/86 https://github.com/libimobiledevice/libplist/commit/7a28a14cf6ed547dfd2e52a4db17f47242bfdef9 Acknowledgment goes to: Francisco Alonso (revskills) References: https://bugzilla.redhat.com/show_bug.cgi?id=1418593 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5836 http://seclists.org/oss-sec/2017/q1/279 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-5836.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5836
Created attachment 713023 [details] PoC file to trigger the issue
QA reproducer: Using the PoC file from attachment 713023 [details] (from the upstream bug) I could reproduce an invalid read with valgrind like this on openSUSE Leap 42.2: valgrind plistutil -i /tmp/cve-2017-5836.plist I couldn't reproduce the segmentation fault as shown in the upstream bug. Our code base is older so probably we're not affected as badly.
bugbot adjusting priority
openSUSE-SU-2017:0528-1: An update that fixes four vulnerabilities is now available. Category: security (moderate) Bug References: 1019531,1023807,1023822,1023848 CVE References: CVE-2017-5209,CVE-2017-5834,CVE-2017-5835,CVE-2017-5836 Sources used: openSUSE Leap 42.1 (src): libplist-1.12-7.1
SUSE-SU-2017:1368-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1019531,1021610,1023807,1023822,1023848,1029631,1035312 CVE References: CVE-2017-5209,CVE-2017-5545,CVE-2017-5834,CVE-2017-5835,CVE-2017-5836,CVE-2017-6440,CVE-2017-7982 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP1 (src): libplist-1.8-10.9.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): libplist-1.8-10.9.1 SUSE Linux Enterprise Software Development Kit 12-SP1 (src): libplist-1.8-10.9.1 SUSE Linux Enterprise Server 12-SP1 (src): libplist-1.8-10.9.1 SUSE Linux Enterprise Desktop 12-SP1 (src): libplist-1.8-10.9.1
SUSE-SU-2017:1379-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1019531,1021610,1023807,1023822,1023848,1029631,1035312 CVE References: CVE-2017-5209,CVE-2017-5545,CVE-2017-5834,CVE-2017-5835,CVE-2017-5836,CVE-2017-6440,CVE-2017-7982 Sources used: SUSE Linux Enterprise Workstation Extension 12-SP2 (src): libplist-1.12-19.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): libplist-1.12-19.1 SUSE Linux Enterprise Server for Raspberry Pi 12-SP2 (src): libplist-1.12-19.1 SUSE Linux Enterprise Server 12-SP2 (src): libplist-1.12-19.1 SUSE Linux Enterprise Desktop 12-SP2 (src): libplist-1.12-19.1
done
openSUSE-SU-2017:1426-1: An update that fixes 7 vulnerabilities is now available. Category: security (moderate) Bug References: 1019531,1021610,1023807,1023822,1023848,1029631,1035312 CVE References: CVE-2017-5209,CVE-2017-5545,CVE-2017-5834,CVE-2017-5835,CVE-2017-5836,CVE-2017-6440,CVE-2017-7982 Sources used: openSUSE Leap 42.2 (src): libplist-1.12-7.3.1