• Martin Szulecki's avatar
    xplist: Fix limited but possible XXE security vulnerability with XML plists · c086cb13
    Martin Szulecki authored
    By using a specifically crafted XML file an attacker could use plistutil
    to issue a GET request to an arbitrary URL or disclose a local file.
    The crafted XML file would be using a custom DTD with an external entity
    reference pointing to the file. Practical abuse is limited but let's still
    fix it nevertheless. Related to CVE-2013-0339 for libxml2 and CWE-827.
    Reported by Loïc Bénis from calypt.com. Thanks!
    c086cb13
Name
Last commit
Last update
..
Array.cpp Loading commit data...
Boolean.cpp Loading commit data...
Data.cpp Loading commit data...
Date.cpp Loading commit data...
Dictionary.cpp Loading commit data...
Integer.cpp Loading commit data...
Key.cpp Loading commit data...
Makefile.am Loading commit data...
Node.cpp Loading commit data...
Real.cpp Loading commit data...
String.cpp Loading commit data...
Structure.cpp Loading commit data...
Uid.cpp Loading commit data...
base64.c Loading commit data...
base64.h Loading commit data...
bplist.c Loading commit data...
bytearray.c Loading commit data...
bytearray.h Loading commit data...
hashtable.c Loading commit data...
hashtable.h Loading commit data...
plist.c Loading commit data...
plist.h Loading commit data...
ptrarray.c Loading commit data...
ptrarray.h Loading commit data...
xplist.c Loading commit data...