Bug 605472 (CVE-2017-5209) – <app-pda/libplist-2.0.0: base64decode buffer over-read via split encoded Apple Property List data (CVE-2017-5209)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Agostino Sarubbo 2017-01-12 13:06:27 UTC]

From ${URL} :

The base64decode function in base64.c in libimobiledevice libplist through 1.12
allows attackers to obtain sensitive information from process memory or cause a
denial of service (buffer over-read) via split encoded Apple Property List data.

Upstream bug:

https://github.com/libimobiledevice/libplist/issues/84

Upstream patch:

https://github.com/libimobiledevice/libplist/commit/3a55ddd3c4c11ce75a86afbefd085d8d397ff957


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 GLSAMaker/CVETool Bot 2017-03-19 14:06:42 UTC]

CVE-2017-5209 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-5209):
  The base64decode function in base64.c in libimobiledevice libplist through
  1.12 allows attackers to obtain sensitive information from process memory or
  cause a denial of service (buffer over-read) via split encoded Apple
  Property List data.

[Comment 2 Aaron Bauman (RETIRED) 2017-07-15 21:55:52 UTC]

Tree is clean.