CVE-2017-5545

The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via Apple Property List data that is too short.

References

Affected packages

Git / github.com/libimobiledevice/libplist

Affected ranges

Type

GIT

Repo

https://github.com/libimobiledevice/libplist

Events

Introduced

Last Affected

27ed36c03297713d2cfa79431cdc8105602e80c2

Fixed

7391a506352c009fe044dead7baad9e22dd279ee

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:libimobiledevice:libplist:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.12"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "7391a506352c009fe044dead7baad9e22dd279ee"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*

1.10

1.11

1.12

1.4

1.5

1.6

1.7

1.8

1.9

Other

libplist_rc1

libplist_rc2

v0.*

v0.10

v0.11

v0.12

v0.13

v0.14

v0.15

v0.16

v0.8

v0.9

v1.*

v1.0

v1.1

v1.2

v1.3

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-5545.json"

vanir_signatures

[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "215229012858047104723625881649240712316",
            "length":  1186
        },
        "id":  "CVE-2017-5545-19a8f293",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee",
        "target":  {
            "file":  "tools/plistutil.c",
            "function":  "main"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "258948382834452506214063809245523802752",
                "186610564183792996153831494707095801239",
                "146331972165227783761996204000359528502",
                "151150956876872385014408689861877055924"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2017-5545-b73054cd",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/libimobiledevice/libplist/commit/7391a506352c009fe044dead7baad9e22dd279ee",
        "target":  {
            "file":  "tools/plistutil.c"
        }
    }
]

vanir_signatures_modified

"2026-10-20T13:22:47Z"