Skip to main content

Libimobiledevice CVE-2017-5835

HIGH
Allocation of Resources Without Limits or Throttling (CWE-770)
2017-03-03 cve@mitre.org
Denial Of Service Libimobiledevice Libplist
7.5
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Mar 03, 2017 - 15:59 cve.org
HIGH 7.5

DescriptionCVE.org

libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.

AnalysisAI

libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.

Technical ContextAI

This vulnerability is classified as Allocation of Resources Without Limits (CWE-770), which allows attackers to exhaust system resources through uncontrolled allocation. libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero. Affected products include: Libimobiledevice Libplist.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Set resource limits, implement rate limiting, validate input sizes.

More in Libimobiledevice

View all
CVE-2017-5545 CRITICAL
9.1 Jan 21

The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive informat
CVE-2017-5209 CRITICAL
9.1 Jan 11

The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive inf
CVE-2017-5836 HIGH
7.5 Mar 03

The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors in
CVE-2013-2142 LOW POC
3.3 Jan 19

userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbit
CVE-2016-5104 MEDIUM
5.3 Jun 13

The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass inten
CVE-2017-5834 MEDIUM
5.5 Mar 03

The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap r
CVE-2017-7982 MEDIUM
5.5 Apr 20

Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote

Same weakness CWE-770 – Allocation of Resources Without Limits or Throttling

View all
CVE-2017-8779 HIGH POC
7.5
CVE-2025-53521 CRITICAL POC
9.3
CVE-2017-5850 HIGH POC
7.5
CVE-2025-26682 HIGH
7.5
CVE-2025-41770 HIGH
8.7
CVE-2025-26466 MEDIUM
5.9
CVE-2020-37067 CRITICAL POC
9.8
CVE-2021-47875 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2017-5835 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy