• Martin Szulecki's avatar
    xplist: Fix limited but possible XXE security vulnerability with XML plists · c086cb13
    Martin Szulecki authored
    By using a specifically crafted XML file an attacker could use plistutil
    to issue a GET request to an arbitrary URL or disclose a local file.
    The crafted XML file would be using a custom DTD with an external entity
    reference pointing to the file. Practical abuse is limited but let's still
    fix it nevertheless. Related to CVE-2013-0339 for libxml2 and CWE-827.
    Reported by Loïc Bénis from calypt.com. Thanks!
    c086cb13
Name
Last commit
Last update
cython Loading commit data...
include Loading commit data...
libcnary Loading commit data...
m4 Loading commit data...
src Loading commit data...
test Loading commit data...
tools Loading commit data...
.gitignore Loading commit data...
AUTHORS Loading commit data...
COPYING Loading commit data...
COPYING.LESSER Loading commit data...
Makefile.am Loading commit data...
NEWS Loading commit data...
README Loading commit data...
autogen.sh Loading commit data...
configure.ac Loading commit data...
doxygen.cfg.in Loading commit data...
libplist++.pc.in Loading commit data...
libplist.pc.in Loading commit data...