CVE-2017-7982

MEDIUM

Libimobiledevice Libplist < 1.12 - Integer Overflow

Title source: rule

Description

Integer overflow in the plist_from_bin function in bplist.c in libimobiledevice/libplist before 2017-04-19 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted plist file.

References (2)

[VDB Entry] https://github.com/libimobiledevice/libplist/issues/103

[Mailing List] https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html

Scores

CVSS v3 5.5

EPSS 0.0040

EPSS Percentile 60.4%

Attack Vector LOCAL

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Classification

CWE

CWE-190

Status draft

Affected Products (1)

libimobiledevice/libplist < 1.12

Timeline

Published Apr 20, 2017

Tracked Since Feb 18, 2026