Heap-Buffer Overflow in SWFTools Affects Multiple Versions
CVE-2022-35080

5.5MEDIUM

Key Information:

Vendor

Swftools

Status
Swftools
Vendor
CVE Published:
13 October 2022

What is CVE-2022-35080?

A heap-buffer overflow vulnerability in SWFTools has been identified, stemming from the png_load function located in /lib/png.c. This flaw can potentially lead to memory corruption, allowing attackers to execute arbitrary code or crash the application, thereby compromising the integrity of systems utilizing SWFTools. Users are urged to review available patches and implement necessary updates to mitigate the risks associated with this vulnerability.

References

https://github.com/matthiaskramm/swftools/issues/183
https://github.com/Cvjark/Poc/blob/main/swftools/png2swf/...

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.