SWFTools 0.9.2 lib/png.c png_load width memory corruption

Summaryinfo

A vulnerability was found in SWFTools 0.9.2. It has been classified as critical. This issue affects the function png_load in the library lib/png.c. The manipulation of the argument width leads to memory corruption. This vulnerability is traded as CVE-2017-16794. An attack has to be approached locally. There is no exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in SWFTools 0.9.2 (Programming Tool Software). This issue affects the function png_load in the library lib/png.c. The manipulation of the argument width with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The png_load function in lib/png.c in SWFTools 0.9.2 does not properly validate a multiplication of width and bits-per-pixel values, which allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via a crafted file, as demonstrated by an erroneous png_load call that occurs because of incorrect integer data types in png2swf.

The bug was discovered 11/11/2017. The weakness was shared 11/12/2017 (Website). The advisory is shared at github.com. The identification of this vulnerability is CVE-2017-16794 since 11/11/2017. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available.

The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-109293 and VDB-109288 are related to this item. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Programming Tool Software

Name

• SWFTools

Version

• 0.9.2

License

• open-source

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion