CVE-2017-8400
HighSummary
In SWFTools version 0.9.2, there is a vulnerability due to an out-of-bounds write in the function png_load() in lib/png.c:755. This issue can be triggered by a malformed PNG file mishandled by png2swf.
Risk Assessment
Attackers could exploit this vulnerability for DoS attacks, which may lead to arbitrary code execution.
Recommendation
It is recommended to update SWFTools to the latest version to mitigate this vulnerability and to monitor systems for unauthorized attempts to exploit this flaw.
Other vulnerabilities in SWFTools 0.9.2
See all- CVE-2017-1000187High
An address access exception was found in SWFTools pdf2swf in the FoFiTrueType::writeTTF() function.
- CVE-2017-16797High
In SWFTools version 0.9.2, the png_load function in lib/png.c does not properly validate the multiplication of width and height values, which can lead to integer overflow, heap-based buffer overflow, and application crash.
- CVE-2017-16796High
In SWFTools 0.9.2, the png_load function in lib/png.c does not check the return value of a realloc call, which allows remote attackers to cause a denial of service (invalid write and application crash) or possibly have unspecified other impact via vectors involving an IDAT tag in a crafted PNG file.
- CVE-2017-16793High
The wav_convert2mono function in SWFTools 0.9.2 does not properly validate WAV data, which may lead to denial of service or other unspecified impacts via a crafted file.
- CVE-2017-11101High
SWFTools version 0.9.2, when processing a crafted file in swfcombine, can lead to a NULL Pointer Dereference in the swf_Relocate() function in lib/modules/swftools.c.
- CVE-2017-11100High
CVE-2017-11100 affects SWFTools version 0.9.2, where processing a crafted file in the swfextract tool can lead to a NULL Pointer Dereference in the swf_FoldSprite() function.
- CVE-2017-11099High
A vulnerability in SWFTools 0.9.2 occurs when processing a crafted file in wav2swf, which can lead to a Segmentation Violation in the wav_convert2mono() function in lib/wav.c.
- CVE-2017-11098High
CVE-2017-11098 affects SWFTools version 0.9.2, where processing a crafted file in png2swf can lead to a Segmentation Violation in the png_load() function in lib/png.c.
- CVE-2017-11097High
SWFTools version 0.9.2, when processing a crafted file in swfc, can lead to a NULL Pointer Dereference in the dict_lookup() function in lib/q.c.
- CVE-2017-11096High
CVE-2017-11096 affects SWFTools 0.9.2, where processing a crafted file in swfcombine can lead to a NULL Pointer Dereference in the swf_DeleteFilter() function in lib/modules/swffilter.c.
Original NVD description (English source)
In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the function png_load() in lib/png.c:755. This issue can be triggered by a malformed PNG file that is mishandled by png2swf. Attackers could exploit this issue for DoS; it might cause arbitrary code execution.