Description
Heap-based buffer overflow in the receive_packet function in libusbmuxd/libusbmuxd.c in usbmuxd 1.0.5 through 1.0.7 allows physically proximate attackers to execute arbitrary code via a long SerialNumber field in a property list.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | usbmuxd | 1.0.7-2 | — |
| Debian 13 | usbmuxd | 1.0.7-2 | — |
| Debian 12 | usbmuxd | 1.0.7-2 | — |
References
- MDVSA-2013:133 vendor-advisory
- [oss-security] 20120119 Re: CVE request: usbmuxd 1.0.7 "receive_packet()" Buffer Overflow Vulnerability mailing-list
- https://wiki.mageia.org/en/Support/Advisories/MGASA-2012-0228
- 51573 vdb-entry
- MDVSA-2012:133 vendor-advisory
- 47545 third-party-advisory
- http://git.marcansoft.com/?p=usbmuxd.git%3Ba=commitdiff%3Bh=f794991993af56a74795891b4ff9da506bc893e6
- usbmuxd-libusbmuxd-bo(72546) vdb-entry
- https://bugs.gentoo.org/show_bug.cgi?id=399409
- [oss-security] 20120119 CVE request: usbmuxd 1.0.7 "receive_packet()" Buffer Overflow Vulnerability mailing-list