Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

azure/libplist can crash from crafted input

published 9 years ago
Summary

The libplist library used in Azure can be forced to allocate a huge amount of memory, causing the program to stop working. An attacker who supplies specially crafted data could make the service unavailable. Update libplist to a newer version or apply the vendor’s patch to stop this from happening.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
Azure Linux:3 azure libplist <= 2.7.0-1
Original advisory text
CVE-2017-5835 affecting package libplist 2.7.0-1
libplist allows attackers to cause a denial of service (large memory allocation and crash) via vectors involving an offset size of zero.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Timeline
Published3 Mar 2017
Updated23 Sep 2026
First seen23 Sep 2026
Sources
AZL-36955 · OSV
Track software like this
Free during beta