Libimobiledevice
Monthly
An out-of-bounds read in libimobiledevice's AFC file handler can disclose a small amount of adjacent memory to a hostile or spoofed AFC peer. Applications linked against libimobiledevice 1.0 through 1.4.0 that call afc_file_open() are affected; the CVSS:4.0 vector rates confidentiality impact as low with no integrity or availability effect, and requires low privileges plus passive user interaction. A public write-up reference exists but is not verified as working exploit code, no CISA KEV entry or other active-exploitation signal is present, and priority is assessed as moderate and non-urgent.
A double free in the AFC service handler of libimobiledevice through 1.4.0 can be triggered when the client processes attacker-controlled data received over the AFC channel, meaning a victim must connect a libimobiledevice-based tool to a malicious or compromised iOS device, or an attacker must interpose on the usbmuxd/AFC communication path. Impact is assessed as low across confidentiality, integrity and availability, consistent with a crash or constrained memory corruption rather than reliable code execution. A public proof-of-concept reference (a write-up) exists but is not verified as working exploit code, no CISA KEV entry is present, and the vendor did not respond to the disclosure.
Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2). Rated low severity (CVSS 3.3). Public exploit code available and no vendor patch available.
An out-of-bounds read in libimobiledevice's AFC file handler can disclose a small amount of adjacent memory to a hostile or spoofed AFC peer. Applications linked against libimobiledevice 1.0 through 1.4.0 that call afc_file_open() are affected; the CVSS:4.0 vector rates confidentiality impact as low with no integrity or availability effect, and requires low privileges plus passive user interaction. A public write-up reference exists but is not verified as working exploit code, no CISA KEV entry or other active-exploitation signal is present, and priority is assessed as moderate and non-urgent.
A double free in the AFC service handler of libimobiledevice through 1.4.0 can be triggered when the client processes attacker-controlled data received over the AFC channel, meaning a victim must connect a libimobiledevice-based tool to a malicious or compromised iOS device, or an attacker must interpose on the usbmuxd/AFC communication path. Impact is assessed as low across confidentiality, integrity and availability, consistent with a crash or constrained memory corruption rather than reliable code execution. A public proof-of-concept reference (a write-up) exists but is not verified as working exploit code, no CISA KEV entry is present, and the vendor did not respond to the disclosure.
Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file. Rated medium severity (CVSS 5.5), this vulnerability is no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read). Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Out-of-bounds Read vulnerability could allow attackers to read data from memory outside the intended buffer boundaries.
The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2). Rated low severity (CVSS 3.3). Public exploit code available and no vendor patch available.