Base Score

HIGH7.5

CVE-2017-5835

libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.

VectorNETWORK

Published Bycve@mitre.org

Published DateMar 03, 2017, 15:59

Weakness Type (CWE):CWE-770

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Severity

HIGH

Version

3.0

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

NONE

Integrity (I)

NONE

Availability (A)

HIGH

References

http://www.openwall.com/lists/oss-security/2017/01/31/6
http://www.openwall.com/lists/oss-security/2017/02/02/4
http://www.securityfocus.com/bid/96022
https://github.com/libimobiledevice/libplist/issues/88
https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html

Base Score

HIGH7.5

Weakness Type (CWE):CWE-770

CVSS Metrics

Base Score

7.5

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Severity

HIGH

Version

3.0

Attack Vector (AV)

NETWORK

Attack Complexity (AC)

LOW

Privileges Required (PR)

NONE

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

NONE

Integrity (I)

NONE

Availability (A)

HIGH