vulnerability

Arch Linux: Arbitrary command execution (CVE-2017-6438)

Try Surface Command

Back to search

Severity

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

Mar 15, 2017

Added

Jul 11, 2025

Modified

Mar 25, 2026

Description

Heap-based buffer overflow in the parse_unicode_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds write) and possibly code execution via a crafted plist file.

Solution

arch-linux-upgrade-latest

References

CVE-2017-6438
https://attackerkb.com/topics/CVE-2017-6438
http://www.securityfocus.com/bid/97281
https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-15495
https://github.com/libimobiledevice/libplist/issues/98
https://security.archlinux.org/ASA-201705-18
CWE-787
EUVD-EUVD-2017-15495

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report