PT-2023-10261 · Libplist+2 · Libplist+2

CVE-2015-10082 · Publicado 2017-05-01 · Atualizado 2024-05-17

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Média

Vetor base

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libplist version 1.12

Description A problematic issue has been found in the XML Handler component of libplist, specifically affecting the plist from xml function in the src/xplist.c file. This issue leads to an xml external entity reference.

Recommendations To fix this issue, apply the patch named c086cb139af7c82845f6d565e636073ff4b37440. As a temporary workaround, consider restricting the use of the plist from xml function in the XML Handler component until the patch is applied.

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

ALT-PU-2017-1551

CVE-2015-10082

SUSE-SU-2023:0872-1

SUSE-SU-2023_0872-1

Produtos afetados

Alt Linux

Suse

Libplist

Referências · 35

• https://github.com/libimobiledevice/libplist/issues/99 · Nota
• https://github.com/libimobiledevice/libplist/issues/100 · Nota
• https://github.com/libimobiledevice/libplist/issues/94 · Nota
• https://github.com/libimobiledevice/libplist/issues/98 · Nota
• https://github.com/libimobiledevice/libplist/issues/95 · Nota
• https://github.com/libimobiledevice/libplist/issues/93 · Nota
• https://github.com/UIKit0/libplist/commit/c086cb139af7c82845f6d565e636073ff4b37440 · Correção
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6440 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5209 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-10082 · Nota de Segurança
• https://suse.com/security/cve/CVE-2015-10082.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6438 · Nota de Segurança
• https://suse.com/support/update/announcement/2023/suse-su-20230872-1 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6439 · Nota de Segurança
• https://bugzilla.suse.com/1208546 · Nota