CVE-2017-5834

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-03-03 · updated 2026-06-17
Weakness: CWE-125

Description

The parse_dict_node function in bplist.c in libplist allows attackers to cause a denial of service (out-of-bounds heap read and crash) via a crafted file.

Affected products

UIKit0 libplist: all versions

References

http://www.openwall.com/lists/oss-security/2017/01/31/6
http://www.openwall.com/lists/oss-security/2017/02/02/4
http://www.securityfocus.com/bid/96022
https://github.com/libimobiledevice/libplist/issues/89
https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html
http://www.openwall.com/lists/oss-security/2017/01/31/6
http://www.openwall.com/lists/oss-security/2017/02/02/4
http://www.securityfocus.com/bid/96022
https://github.com/libimobiledevice/libplist/issues/89
https://lists.debian.org/debian-lts-announce/2020/04/msg00002.html

Get alerted when CVE-2017-5834 or the next vulnerability affects your stack