The plist_free_data function in plist.c in libplist allows attackers to cause a denial of service (crash) via vectors involving an integer node that is treated as a PLIST_KEY and then triggers an invalid free.
The product calls free() twice on the same memory address.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Libplist | Libimobiledevice | * | * |
| Libplist | Ubuntu | esm-infra/xenial | * |
| Libplist | Ubuntu | precise | * |
| Libplist | Ubuntu | trusty | * |
| Libplist | Ubuntu | upstream | * |
| Libplist | Ubuntu | vivid/stable-phone-overlay | * |
| Libplist | Ubuntu | xenial | * |
| Libplist | Ubuntu | yakkety | * |
| Libplist | Ubuntu | zesty | * |