Latest vulnerabilities for "suse libimobiledevice"

Where

Sort:

Versions

1.1.4

1.2.0

libimobiledevice libimobiledeviceThe socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attac…

Risk 28

Severity

5.3

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

It was found that libimobiledevice and libusbmuxd libraries accidentally bound a listening IPv4 TCP socket to INADDRANY instead of INADDRLOOPBACK.

This socket is used to communicate with services on an iOS device. The impact is accidental exposure of the iOS device to attackers on the local network. The RHEL workstation itself is not exposed, nor is there an easy escalation for attackers to gain access to the host.

Upstream patches:

libusbmuxd: https://github.com/libimobiledevice/libusbmuxd/commit/4397b3376dc4e4cb1c991d0aed61ce6482614196

libimobiledevice: https://github.com/libimobiledevice/libimobiledevice/commit/df1f5c4d70d0c19ad40072f5246ca457e7f9849e

CVE request:

http://seclists.org/oss-sec/2016/q2/410

1 / 2

Source: Red Hat

First published (updated )

CVE-2016-5104

libimobiledevice libimobiledeviceuserpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local user…

Risk 22

Severity

3.3

AV:L/AC:M/Au:N/C:N/I:P/A:P

userpref.c in libimobiledevice 1.1.4, when $HOME and $XDGCONFIGHOME are not set, allows local users to overwrite arbitrary files via a symlink attack on (1) HostCertificate.pem, (2) HostPrivateKey.pem, (3) libimobiledevicerc, (4) RootCertificate.pem, or (5) RootPrivateKey.pem in /tmp/root/.config/libimobiledevice/.

First published (updated )

CVE-2013-2142

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.