Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 617252 (CVE-2017-8400, CVE-2017-8401) - media-gfx/swftools: two heap out-of-bounds
Summary: media-gfx/swftools: two heap out-of-bounds
Status: RESOLVED FIXED
Alias: CVE-2017-8400, CVE-2017-8401
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL:
Whiteboard: ~2 [noglsa cve]
Keywords:
Depends on: CVE-2017-16868
Blocks:
  Show dependency tree
 
Reported: 2017-05-02 15:41 UTC by GLSAMaker/CVETool Bot
Modified: 2019-04-30 00:09 UTC (History)
3 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description GLSAMaker/CVETool Bot gentoo-dev 2017-05-02 15:41:03 UTC
CVE-2017-8401 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8401):
  In SWFTools 0.9.2, an out-of-bounds read of heap data can occur in the
  function png_load() in lib/png.c:724. This issue can be triggered by a
  malformed PNG file that is mishandled by png2swf. Attackers could exploit
  this issue for DoS.

CVE-2017-8400 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2017-8400):
  In SWFTools 0.9.2, an out-of-bounds write of heap data can occur in the
  function png_load() in lib/png.c:755. This issue can be triggered by a
  malformed PNG file that is mishandled by png2swf. Attackers could exploit
  this issue for DoS; it might cause arbitrary code execution.
Comment 1 Thomas Deutschmann gentoo-dev Security 2017-06-04 22:32:38 UTC
@ Maintainer(s): Please do a snapshot release from https://github.com/matthiaskramm/swftools
Comment 2 Larry the Git Cow gentoo-dev 2019-03-29 23:53:04 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=b1d6b78e63660d748d81395bb01c5c63d553cf37

commit b1d6b78e63660d748d81395bb01c5c63d553cf37
Author:     Aaron Bauman <bman@gentoo.org>
AuthorDate: 2019-03-29 23:49:20 +0000
Commit:     Aaron Bauman <bman@gentoo.org>
CommitDate: 2019-03-29 23:49:20 +0000

    package.mask: Last-rite media-gfx/swftools
    
    * Multiple outstanding security vulnerabilities
    * No upstream releases in years
    * Maintainers have not patched
    
    Bug: https://bugs.gentoo.org/617252
    Bug: https://bugs.gentoo.org/635208
    Bug: https://bugs.gentoo.org/637172
    Bug: https://bugs.gentoo.org/650888
    
    Signed-off-by: Aaron Bauman <bman@gentoo.org>

 profiles/package.mask | 6 ++++++
 1 file changed, 6 insertions(+)
Comment 3 Larry the Git Cow gentoo-dev 2019-04-28 20:02:49 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=32edfe461d949f5b809fefe51e0248c2c27f53b4

commit 32edfe461d949f5b809fefe51e0248c2c27f53b4
Author:     Michał Górny <mgorny@gentoo.org>
AuthorDate: 2019-04-28 20:01:03 +0000
Commit:     Michał Górny <mgorny@gentoo.org>
CommitDate: 2019-04-28 20:02:33 +0000

    media-gfx/swftools: Remove last-rited pkg
    
    Bug: https://bugs.gentoo.org/650888
    Bug: https://bugs.gentoo.org/637172
    Bug: https://bugs.gentoo.org/635208
    Bug: https://bugs.gentoo.org/617252
    Signed-off-by: Michał Górny <mgorny@gentoo.org>

 media-gfx/swftools/Manifest                        |  1 -
 .../swftools/files/swftools-0.9.2-jpeg-9.patch     | 17 -----
 .../swftools/files/swftools-0.9.2_general.patch    | 28 -------
 .../swftools/files/swftools-0.9.2_giflib.patch     | 89 ----------------------
 .../swftools/files/swftools-0.9.2_giflib5.patch    | 26 -------
 .../swftools/files/swftools-0.9.2_nopdf.patch      | 40 ----------
 media-gfx/swftools/metadata.xml                    |  5 --
 media-gfx/swftools/swftools-0.9.2-r1.ebuild        | 48 ------------
 profiles/package.mask                              |  6 --
 9 files changed, 260 deletions(-)