Bug 661152 – media-libs/ming: Multiple vulnerabilities

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description GLSAMaker/CVETool Bot 2018-07-14 16:13:02 UTC]

CVE-2018-9165 (https://nvd.nist.gov/vuln/detail/CVE-2018-9165):
  The pushdup function in util/decompile.c in libming through 0.4.8 does not
  recognize the need for ActionPushDuplicate to perform a deep copy when a
  String is at the top of the stack, making the library vulnerable to a
  util/decompile.c getName NULL pointer dereference, which may allow attackers
  to cause a denial of service via a crafted SWF file.

CVE-2018-9132 (https://nvd.nist.gov/vuln/detail/CVE-2018-9132):
  libming 0.4.8 has a NULL pointer dereference in the getInt function of the
  decompile.c file. Remote attackers could leverage this vulnerability to
  cause a denial of service via a crafted swf file.

CVE-2018-13251 (https://nvd.nist.gov/vuln/detail/CVE-2018-13251):
  In libming 0.4.8, there is an excessive memory allocation attempt in the
  readBytes function of the util/read.c file, related to
  parseSWF_DEFINEBITSJPEG2. Remote attackers could leverage this vulnerability
  to cause a denial-of-service via a crafted swf file.

CVE-2018-13250 (https://nvd.nist.gov/vuln/detail/CVE-2018-13250):
  libming 0.4.8 has a NULL pointer dereference in the getString function of
  the decompile.c file, related to decompileSTRINGCONCAT. Remote attackers
  could leverage this vulnerability to cause a denial of service via a crafted
  swf file.

CVE-2018-13066 (https://nvd.nist.gov/vuln/detail/CVE-2018-13066):
  There is a memory leak in util/parser.c in libming 0.4.8, which will lead to
  a denial of service via parseSWF_DEFINEBUTTON2, parseSWF_DEFINEFONT,
  parseSWF_DEFINEFONTINFO, parseSWF_DEFINELOSSLESS, parseSWF_DEFINESPRITE,
  parseSWF_DEFINETEXT, parseSWF_DOACTION, parseSWF_FILLSTYLEARRAY,
  parseSWF_FRAMELABEL, parseSWF_LINESTYLEARRAY, parseSWF_PLACEOBJECT2, or
  parseSWF_SHAPEWITHSTYLE.

CVE-2018-11226 (https://nvd.nist.gov/vuln/detail/CVE-2018-11226):
  The getString function in decompile.c in libming through 0.4.8 mishandles
  cases where the header indicates a file size greater than the actual size,
  which allows remote attackers to cause a denial of service (Segmentation
  fault and application crash) or possibly have unspecified other impact.

CVE-2018-11225 (https://nvd.nist.gov/vuln/detail/CVE-2018-11225):
  The dcputs function in decompile.c in libming through 0.4.8 mishandles cases
  where the header indicates a file size greater than the actual size, which
  allows remote attackers to cause a denial of service (Segmentation fault and
  application crash) or possibly have unspecified other impact.

CVE-2018-11100 (https://nvd.nist.gov/vuln/detail/CVE-2018-11100):
  The decompileSETTARGET function in decompile.c in libming through 0.4.8
  mishandles cases where the header indicates a file size greater than the
  actual size, which allows remote attackers to cause a denial of service
  (Segmentation fault and application crash) or possibly have unspecified
  other impact.

CVE-2018-11095 (https://nvd.nist.gov/vuln/detail/CVE-2018-11095):
  The decompileJUMP function in decompile.c in libming through 0.4.8
  mishandles cases where the header indicates a file size greater than the
  actual size, which allows remote attackers to cause a denial of service
  (Segmentation fault and application crash) or possibly have unspecified
  other impact.

CVE-2018-11017 (https://nvd.nist.gov/vuln/detail/CVE-2018-11017):
  The newVar_N function in decompile.c in libming through 0.4.8 mishandles
  cases where the header indicates a file size greater than the actual size,
  which allows remote attackers to cause a denial of service (Segmentation
  fault and application crash) or possibly have unspecified other impact.

[Comment 1 Aaron Bauman (RETIRED) 2019-04-05 01:21:29 UTC]

Only CVE-2018-9165 is fixed in =media-libs/ming-0.20181112

[Comment 2 Larry the Git Cow 2019-08-04 19:36:19 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=f85984054ed9f49d7245234ee6aa9e737607f148

commit f85984054ed9f49d7245234ee6aa9e737607f148
Author:     Aaron Bauman <[e-mail]>
AuthorDate: 2019-08-04 19:29:04 +0000
Commit:     Aaron Bauman <[e-mail]>
CommitDate: 2019-08-04 19:29:04 +0000

    profiles/package.mask: add media-libs/ming
    
    Bug: https://bugs.gentoo.org/626412
    Bug: https://bugs.gentoo.org/650006
    Bug: https://bugs.gentoo.org/651574
    Bug: https://bugs.gentoo.org/661152
    Bug: https://bugs.gentoo.org/678804
    
    Signed-off-by: Aaron Bauman <[e-mail]>

 profiles/package.mask | 5 +++++
 1 file changed, 5 insertions(+)

[Comment 3 Michał Górny 2019-09-06 07:23:46 UTC]

The package has been removed.