CVE-2017-5836

High

Published: 03/03/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY, leading to an invalid free.

Risk Assessment

Attackers can exploit this vulnerability to disrupt application functionality, potentially leading to service outages and loss of system availability.

Recommendation

It is recommended to update libplist to the latest version to mitigate this vulnerability and to monitor systems for unauthorized attempts to exploit this flaw.

Other vulnerabilities in libplist

CVE-2017-5835High
libplist allows attackers to cause a denial of service through large memory allocation and crash via vectors involving an offset size of zero.

Original NVD description (English source)

The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.