Skip to main content

Libimobiledevice CVE-2017-5836

HIGH
Double Free (CWE-415)
2017-03-03 cve@mitre.org
Denial Of Service Libimobiledevice Libplist
7.5
CVSS 3.0 · NVD
Share

Severity by source

NVD PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

1
CVE Published
Mar 03, 2017 - 15:59 cve.org
HIGH 7.5

DescriptionCVE.org

The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.

AnalysisAI

The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

Technical ContextAI

This vulnerability is classified under CWE-415. The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free. Affected products include: Libimobiledevice Libplist.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Libimobiledevice

View all
CVE-2017-5545 CRITICAL
9.1 Jan 21

The main function in plistutil.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive informat
CVE-2017-5209 CRITICAL
9.1 Jan 11

The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive inf
CVE-2017-5835 HIGH
7.5 Mar 03

libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offs
CVE-2013-2142 LOW POC
3.3 Jan 19

userpref.c in libimobiledevice 1.1.4, when $HOME and $XDG_CONFIG_HOME are not set, allows local users to overwrite arbit
CVE-2016-5104 MEDIUM
5.3 Jun 13

The socket_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass inten
CVE-2017-5834 MEDIUM
5.5 Mar 03

The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap r
CVE-2017-7982 MEDIUM
5.5 Apr 20

Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote

Same weakness CWE-415 – Double Free

View all
CVE-2014-0502 HIGH POC
8.8
CVE-2018-0101 CRITICAL POC
10.0
CVE-2023-25136 MEDIUM POC
6.5
CVE-2026-33824 CRITICAL POC
9.8
CVE-2014-1767 HIGH POC
7.2
CVE-2016-5768 CRITICAL POC
9.8
CVE-2016-5772 CRITICAL POC
9.8
CVE-2016-3132 CRITICAL POC
9.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Share

CVE-2017-5836 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy