FEDORA-2017-3849af4477 — security update for libplist

stable

libplist-2.0.0-1.fc24

FEDORA-2017-3849af4477 created by pbrobinson 5 years ago for Fedora 24

Version 2.0.0

Changes:

New light-weight custom XML parser
Remove libxml2 dependency
Refactor binary plist parsing
Improved malformed XML and binary plist detection and error handling
Add parser debug/error output (when compiled with --enable-debug), controlled via environment variables
Fix unicode character handling
Add PLIST_IS_* helper macros for the different node types
Extend date/time range and date conversion issues
Add plist_is_binary() and plist_from_memory() functions to the interface
Plug several memory leaks
Speed improvements for handling large plist files

Includes security fixes for:

CVE-2017-6440
CVE-2017-6439
CVE-2017-6438
CVE-2017-6437
CVE-2017-6436
CVE-2017-6435
CVE-2017-5836
CVE-2017-5835
CVE-2017-5834
CVE-2017-5545
CVE-2017-5209

... and several others that didn't receive any CVE (yet).

How to install

sudo dnf upgrade --refresh --advisory=FEDORA-2017-3849af4477

This update has been submitted for testing by pbrobinson.

5 years ago

This update has been pushed to testing.

5 years ago

filiperosset commented & provided feedback 5 years ago

karma

no regressions noted

pwhalen commented & provided feedback 5 years ago

karma

Looks good.

This update has been submitted for stable by pbrobinson.

5 years ago

This update has been pushed to stable.

5 years ago

Please login to add feedback.

Metadata

Type

security

Karma

Signed

Content Type

RPM

Test Gating

None

Builds

libplist-2.0.0-1.fc24

Settings

Unstable by Karma

-3

Stable by Karma

disabled

Stable by Time

disabled

Dates

submitted

5 years ago

in testing

5 years ago

in stable

5 years ago

BZ#1412613 CVE-2017-5209 libplist: base64decode buffer over-read via split encoded Apple Property List data

BZ#1412614 CVE-2017-5209 libplist: base64decode buffer over-read via split encoded Apple Property List data [fedora-all]

BZ#1416008 CVE-2017-5545 libplist: Heap-buffer overflow in plistutil [fedora-all]

BZ#1418597 CVE-2017-5834 CVE-2017-5835 CVE-2017-5836 libplist: various flaws [fedora-all]

BZ#1432951 CVE-2017-6436 libplist: Integer overflow in parse_string_node

BZ#1432954 CVE-2017-6437 libplist: Out-of-bounds heap read in base64encode function

BZ#1432956 CVE-2017-6438 libplist: Heap-based buffer overflow in parse_unicode_node

BZ#1432959 CVE-2017-6439 libplist: Heap-based buffer overflow in parse_string_node

BZ#1432965 CVE-2017-6440 libplist: Memory allocation error in parse_data_node

BZ#1432971 CVE-2017-6435 CVE-2017-6436 CVE-2017-6437 CVE-2017-6438 CVE-2017-6439 CVE-2017-6440 CVE-2017-7982 libplist: various flaws [fedora-all]

libplist-2.0.0-1.fc24

Automated Test Results

None