PT-2023-10261 · Libplist+2 · Libplist+2

Published 2017-05-01 · Updated 2024-05-17 · CVE-2015-10082

Positive Technologies (AI Summary)

CVSS v2.0

5.2

Medium

Base vector

AV:A/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions libplist version 1.12

Description A problematic issue has been found in the XML Handler component of libplist, specifically affecting the plist from xml function in the src/xplist.c file. This issue leads to an xml external entity reference.

Recommendations To fix this issue, apply the patch named c086cb139af7c82845f6d565e636073ff4b37440. As a temporary workaround, consider restricting the use of the plist from xml function in the XML Handler component until the patch is applied.

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

ALT-PU-2017-1551

CVE-2015-10082

SUSE-SU-2023:0872-1

SUSE-SU-2023_0872-1

Affected Products

Alt Linux

Suse

Libplist

References · 35

• https://github.com/UIKit0/libplist/commit/c086cb139af7c82845f6d565e636073ff4b37440 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6440 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5209 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-10082 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6438 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6439 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5836 · Security Note
• https://errata.altlinux.org/ALT-PU-2017-1551 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6437 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5545 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-10082 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6436 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5834 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2023:0872-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7982 · Security Note