CVE-2012-0065

Name	CVE-2012-0065
Description	Heap-based buffer overflow in the receive_packet function in libusbmuxd/libusbmuxd.c in usbmuxd 1.0.5 through 1.0.7 allows physically proximate attackers to execute arbitrary code via a long SerialNumber field in a property list.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium (attack range: local)
Debian Bugs	656581

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
usbmuxd (PTS)	jessie	1.0.8+git20140527.e72f2f7-2	fixed
	stretch	1.1.0-2	fixed
	buster, bullseye, sid	1.1.1~git20181007.f838cf6-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
usbmuxd	source	(unstable)	1.0.7-2	medium	656581
usbmuxd	source	lenny	(not affected)
usbmuxd	source	squeeze	(not affected)

[lenny] - usbmuxd <not-affected> (introduced in 1.0.7)
[squeeze] - usbmuxd <not-affected> (introduced in 1.0.7)