Remote Code Execution Vulnerability in SWFTools by SWFTools
CVE-2017-16794

5.5MEDIUM

Key Information:

Vendor

Swftools

Status
Swftools
Vendor
CVE Published:
3 October 2022

What is CVE-2017-16794?

The png_load function in SWFTools 0.9.2 fails to validate the multiplication of width and bits-per-pixel, enabling remote attackers to exploit this flaw. By providing specially crafted PNG files, attackers can trigger a buffer over-read, potentially leading to application crashes. This vulnerability arises from the incorrect handling of integer data types within the png2swf program, allowing for significant disruption if exploited.

References

https://github.com/matthiaskramm/swftools/issues/50
x_refsource_MISC

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.