CVE-2017-5836: Double Free
The plistfreedata function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLISTKEY and then triggers an invalid free.
Other sources
The plistfreedata function libplist allows attackers to cause a denial of service
— Microsoft
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5836?
CVE-2017-5836 has been classified as a denial of service vulnerability that can lead to application crashes.
How do I fix CVE-2017-5836?
To mitigate CVE-2017-5836, users should apply the patches released by the libimobiledevice project for libplist.
What software is affected by CVE-2017-5836?
CVE-2017-5836 affects the libplist component used in libimobiledevice.
Can CVE-2017-5836 be exploited remotely?
CVE-2017-5836 is a local vulnerability that requires the attacker to have access to manipulate plist files.
What are the consequences of exploiting CVE-2017-5836?
Exploiting CVE-2017-5836 can lead to a denial of service, causing the application to crash.