CVE-2017-9926
HighSummary
In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted file.
Risk Assessment
Attackers may exploit this vulnerability to disrupt system operations, potentially leading to service downtime for the organization.
Recommendation
It is recommended to update SWFTools to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in SWFTools 2013-04-09-1007
See all- CVE-2017-1000187High
An address access exception was found in SWFTools pdf2swf in the FoFiTrueType::writeTTF() function.
- CVE-2017-16797High
In SWFTools version 0.9.2, the png_load function in lib/png.c does not properly validate the multiplication of width and height values, which can lead to integer overflow, heap-based buffer overflow, and application crash.
- CVE-2017-16796High
In SWFTools 0.9.2, the png_load function in lib/png.c does not check the return value of a realloc call, which allows remote attackers to cause a denial of service (invalid write and application crash) or possibly have unspecified other impact via vectors involving an IDAT tag in a crafted PNG file.
- CVE-2017-16793High
The wav_convert2mono function in SWFTools 0.9.2 does not properly validate WAV data, which may lead to denial of service or other unspecified impacts via a crafted file.
- CVE-2017-11101High
SWFTools version 0.9.2, when processing a crafted file in swfcombine, can lead to a NULL Pointer Dereference in the swf_Relocate() function in lib/modules/swftools.c.
- CVE-2017-11100High
CVE-2017-11100 affects SWFTools version 0.9.2, where processing a crafted file in the swfextract tool can lead to a NULL Pointer Dereference in the swf_FoldSprite() function.
- CVE-2017-11099High
A vulnerability in SWFTools 0.9.2 occurs when processing a crafted file in wav2swf, which can lead to a Segmentation Violation in the wav_convert2mono() function in lib/wav.c.
- CVE-2017-11098High
CVE-2017-11098 affects SWFTools version 0.9.2, where processing a crafted file in png2swf can lead to a Segmentation Violation in the png_load() function in lib/png.c.
- CVE-2017-11097High
SWFTools version 0.9.2, when processing a crafted file in swfc, can lead to a NULL Pointer Dereference in the dict_lookup() function in lib/q.c.
- CVE-2017-11096High
CVE-2017-11096 affects SWFTools 0.9.2, where processing a crafted file in swfcombine can lead to a NULL Pointer Dereference in the swf_DeleteFilter() function in lib/modules/swffilter.c.
Original NVD description (English source)
In SWFTools 2013-04-09-1007 on Windows, png2swf allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted file, related to a "Read Access Violation starting at image00000000_00400000+0x000000000001b596."